refactor(crypto): extract governance vote message and verification helpers

refactor(db): declare unixepoch instead of formatting a SQL fragment
perf(proposal): replace the per-proposal tally loop with one grouped query
2026-08-27 16:44:22 +02:00 · 2026-08-27 14:08:48 +02:00 · 2026-08-27 14:00:14 +02:00 · 2026-08-27 13:50:02 +02:00 · 2026-08-27 13:42:14 +02:00 · 2026-08-27 12:46:40 +02:00
51 changed files with 5515 additions and 262 deletions
--- a/protobufs/operator/governance.proto
+++ b/protobufs/operator/governance.proto
@@ -2,6 +2,8 @@ syntax = "proto3";

 package arbiter.operator.governance;

+import "google/protobuf/empty.proto";
+
 message Request {
  oneof payload {
    CreateProposalRequest create = 1;
@@ -13,14 +15,13 @@ message Request {
 message CreateProposalRequest {
  oneof kind {
    ApproveSdkClientPayload         approve_sdk_client          = 1;
-    GrantWalletAccessPayload        grant_wallet_access         = 3;
-    ApproveServerUpdatePayload      approve_server_update       = 4;
-    ReplaceOperatorPayload          replace_operator            = 5;
-    UpdateShamirParametersPayload   update_shamir_parameters    = 6;
-    ApprovePersistentGrantPayload   approve_persistent_grant    = 7;
-    ApproveOneOffTransactionPayload approve_one_off_transaction = 8;
+    GrantWalletAccessPayload        grant_wallet_access         = 2;
+    ReplaceOperatorPayload          replace_operator            = 3;
+    google.protobuf.Empty           trigger_rekey               = 4;
+    ApprovePersistentGrantPayload   approve_persistent_grant    = 5;
+    ApproveOneOffTransactionPayload approve_one_off_transaction = 6;
  }
-  optional uint32 ttl_secs = 2;
+  optional uint32 ttl_secs = 7;
 }

 message ReplaceOperatorPayload {
@@ -28,12 +29,6 @@ message ReplaceOperatorPayload {
  bytes new_pubkey      = 2;
 }

-message UpdateShamirParametersPayload {
-  uint32 new_n = 1;
-}
-
-message ApproveServerUpdatePayload {}
-
 message ApproveSdkClientPayload {
  int32 client_id = 1;
 }
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -24,7 +24,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
 "crypto-common 0.1.7",
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -707,6 +707,7 @@ dependencies = [
 "memsafe",
 "ml-dsa",
 "rand 0.10.1",
+ "strum 0.28.0",
 "thiserror",
 "x-wing",
 ]
@@ -769,8 +770,10 @@ dependencies = [
 "mutants",
 "pem",
 "proptest",
+ "prost",
 "prost-types",
 "rand 0.10.1",
+ "rand_core 0.6.4",
 "rcgen",
 "restructed",
 "rstest",
@@ -786,6 +789,7 @@ dependencies = [
 "tonic",
 "tracing",
 "tracing-subscriber",
+ "vsss-rs",
 "x25519-dalek 2.0.1",
 ]

@@ -1283,7 +1287,7 @@ version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -1612,8 +1616,22 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 "rand_core 0.6.4",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-bigint"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96272c2ff28b807e09250b180ad1fb7889a3258f7455759b5c3c58b719467130"
+dependencies = [
+ "num-traits",
+ "rand_core 0.6.4",
+ "serdect 0.3.0",
 "subtle",
 "zeroize",
 ]
@@ -1624,7 +1642,7 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 "rand_core 0.6.4",
 "typenum",
 ]
@@ -1927,7 +1945,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -2007,7 +2025,7 @@ dependencies = [
 "digest 0.10.7",
 "elliptic-curve",
 "rfc6979",
- "serdect",
+ "serdect 0.2.0",
 "signature 2.2.0",
 "spki 0.7.3",
 ]
@@ -2040,16 +2058,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
 "base16ct",
- "crypto-bigint",
+ "crypto-bigint 0.5.5",
 "digest 0.10.7",
 "ff",
- "generic-array",
+ "generic-array 0.14.7",
 "group",
+ "hkdf",
 "pkcs8 0.10.2",
 "rand_core 0.6.4",
 "sec1",
- "serdect",
+ "serdect 0.2.0",
 "subtle",
+ "tap",
+ "zeroize",
+]
+
+[[package]]
+name = "elliptic-curve-tools"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1de2b6fae800f08032a6ea32995b52925b1d451bff9d445c8ab2932323277faf"
+dependencies = [
+ "elliptic-curve",
+ "heapless",
+ "hex",
+ "multiexp",
+ "serde",
 "zeroize",
 ]

@@ -2123,6 +2157,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
+ "bitvec",
 "rand_core 0.6.4",
 "subtle",
 ]
@@ -2323,6 +2358,17 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "generic-array"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab9e9188e97a93276e1fe7b56401b851e2b45a46d045ca658100c1303ada649"
+dependencies = [
+ "rustversion",
+ "serde_core",
+ "typenum",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -2406,6 +2452,15 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -2446,6 +2501,16 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"

+[[package]]
+name = "heapless"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -2473,6 +2538,15 @@ dependencies = [
 "arrayvec",
 ]

+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac 0.12.1",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -2543,6 +2617,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
 dependencies = [
 "ctutils",
+ "serde",
 "typenum",
 "zeroize",
 ]
@@ -2808,7 +2883,7 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -2947,15 +3022,15 @@ dependencies = [
 "ecdsa",
 "elliptic-curve",
 "once_cell",
- "serdect",
+ "serdect 0.2.0",
 "sha2 0.10.9",
 "signature 2.2.0",
 ]

 [[package]]
 name = "kameo"
-version = "0.20.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+version = "0.22.2"
+source = "git+https://github.com/hdbg/kameo.git?rev=17af90e3#17af90e3ae95fc6f89fa31a2f1b9506ac127f0b7"
 dependencies = [
 "downcast-rs",
 "dyn-clone",
@@ -2968,8 +3043,8 @@ dependencies = [

 [[package]]
 name = "kameo_actors"
-version = "0.5.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+version = "0.8.1"
+source = "git+https://github.com/hdbg/kameo.git?rev=17af90e3#17af90e3ae95fc6f89fa31a2f1b9506ac127f0b7"
 dependencies = [
 "futures",
 "glob",
@@ -2980,14 +3055,13 @@ dependencies = [

 [[package]]
 name = "kameo_macros"
-version = "0.20.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+version = "0.21.1"
+source = "git+https://github.com/hdbg/kameo.git?rev=17af90e3#17af90e3ae95fc6f89fa31a2f1b9506ac127f0b7"
 dependencies = [
- "darling 0.23.0",
 "heck",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -3290,6 +3364,20 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "multiexp"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ec2ce93a6f06ac6cae04c1da3f2a6a24fcfc1f0eb0b4e0f3d302f0df45326cb"
+dependencies = [
+ "ff",
+ "group",
+ "rand_core 0.6.4",
+ "rustversion",
+ "std-shims",
+ "zeroize",
+]
+
 [[package]]
 name = "multimap"
 version = "0.10.1"
@@ -3321,6 +3409,20 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -3329,6 +3431,19 @@ checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
 dependencies = [
 "num-integer",
 "num-traits",
+ "rand 0.8.6",
+ "serde",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+ "rand 0.8.6",
+ "serde",
 ]

 [[package]]
@@ -3346,6 +3461,29 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+ "serde",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -4454,9 +4592,9 @@ checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
 "base16ct",
 "der 0.7.10",
- "generic-array",
+ "generic-array 0.14.7",
 "pkcs8 0.10.2",
- "serdect",
+ "serdect 0.2.0",
 "subtle",
 "zeroize",
 ]
@@ -4622,6 +4760,16 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "serdect"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f42f67da2385b51a5f9652db9c93d78aeaf7610bf5ec366080b6de810604af53"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -4787,6 +4935,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "spin"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -4831,6 +4985,17 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"

+[[package]]
+name = "std-shims"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "227c4f8561598188d0df96dbe749824576174bba278b5b6bb2eacff1066067d0"
+dependencies = [
+ "hashbrown 0.16.1",
+ "rustversion",
+ "spin",
+]
+
 [[package]]
 name = "string_morph"
 version = "0.1.0"
@@ -4934,6 +5099,17 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "syn"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn-solidity"
 version = "1.5.7"
@@ -5574,6 +5750,27 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"

+[[package]]
+name = "vsss-rs"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ec751bdcc8bda099e269b24cc6b4ad14f9ce8b0490c1599174070e792ecd70c"
+dependencies = [
+ "crypto-bigint 0.5.5",
+ "crypto-bigint 0.6.1",
+ "elliptic-curve",
+ "elliptic-curve-tools",
+ "generic-array 1.4.1",
+ "hex",
+ "hybrid-array",
+ "num",
+ "rand_core 0.6.4",
+ "serde",
+ "sha3 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "wait-timeout"
 version = "0.2.1"
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -12,8 +12,8 @@ base64 = "0.22.1"
 chrono = { version = "0.4.44", features = ["serde"] }
 futures = "0.3.32"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
-kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
-kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
+kameo = {git = "https://github.com/hdbg/kameo.git", rev = "17af90e3"}
+kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "17af90e3"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
 ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
@@ -27,6 +27,7 @@ rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post
 rustls-pki-types = "1.14.1"
 sha2 = "0.11"
 smlang = "0.8.0"
+strum = { version = "0.28.0", features = ["derive"] }
 thiserror = "2.0.18"
 tokio = { version = "1.52.1", features = ["full"] }
 tokio-stream = { version = "0.1.18", features = ["full"] }
@@ -106,7 +107,6 @@ indexing_slicing = "warn"
 infinite_loop = "warn"
 inline_asm_x86_att_syntax = "warn"
 inline_asm_x86_intel_syntax = "warn"
-integer_division = "warn"
 large_include_file = "warn"
 lossy_float_literal = "warn"
 map_with_unused_argument_over_ranges = "warn"
@@ -168,3 +168,4 @@ nursery = { level = "warn", priority = -1 }
 pedantic = { level = "warn", priority = -1 }

 type_repetition_in_bounds = "allow"   # sometimes, it's better for readability this way
+unused_async_trait_impl = "allow"
--- a/server/clippy.toml
+++ b/server/clippy.toml
@@ -26,3 +26,5 @@ trait-assoc-item-kinds-order = [
    "type",
    "fn",
 ] # community tested standard
+
+too-many-lines-threshold = 150
--- a/server/crates/arbiter-client/src/auth.rs
+++ b/server/crates/arbiter-client/src/auth.rs
@@ -2,7 +2,7 @@ use crate::{
    storage::StorageError,
    transport::{ClientTransport, next_request_id},
 };
-use arbiter_crypto::authn::{self, CLIENT_CONTEXT, SigningKey};
+use arbiter_crypto::authn::{self, SigningContext, SigningKey};
 use arbiter_proto::{
    ClientMetadata,
    proto::{
@@ -110,7 +110,7 @@ async fn send_auth_challenge_solution(
    };
    let challenge_payload: Vec<u8> = challenge.format();
    let signature = key
-        .sign_message(&challenge_payload, CLIENT_CONTEXT)
+        .sign_message(&challenge_payload, SigningContext::Client)
        .map_err(|_| AuthError::UnexpectedAuthResponse)?
        .to_bytes();

--- a/server/crates/arbiter-crypto/Cargo.toml
+++ b/server/crates/arbiter-crypto/Cargo.toml
@@ -7,6 +7,7 @@ edition = "2024"
 ml-dsa = {workspace = true, optional = true }
 rand = {workspace = true, optional = true}
 memsafe = {version = "0.4.0", optional = true}
+strum = { workspace = true, optional = true }
 hmac.workspace = true
 alloy.workspace = true
 x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] }
@@ -18,7 +19,7 @@ workspace = true

 [features]
 default = ["authn", "safecell"]
-authn = ["dep:ml-dsa", "dep:rand"]
+authn = ["dep:ml-dsa", "dep:rand", "dep:strum"]
 safecell = ["dep:memsafe"]

 [lib]
--- a/server/crates/arbiter-crypto/src/authn/v1.rs
+++ b/server/crates/arbiter-crypto/src/authn/v1.rs
@@ -5,9 +5,25 @@ use ml_dsa::{
    SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
 };
 use rand::RngExt;
+use strum::IntoStaticStr;

-pub static CLIENT_CONTEXT: &[u8] = b"arbiter_client";
-pub static OPERATOR_CONTEXT: &[u8] = b"arbiter_operator";
+/// Domain separation tag mixed into every ML-DSA signature.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, IntoStaticStr)]
+pub enum SigningContext {
+    #[strum(serialize = "arbiter_client")]
+    Client,
+    #[strum(serialize = "arbiter_operator")]
+    Operator,
+    #[strum(serialize = "arbiter_governance_vote")]
+    GovernanceVote,
+}
+
+impl SigningContext {
+    #[must_use]
+    pub fn as_bytes(self) -> &'static [u8] {
+        <&'static str>::from(self).as_bytes()
+    }
+}

 const NONCE_SIZE: usize = 32;

@@ -85,10 +101,26 @@ impl PublicKey {
    }

    #[must_use]
-    pub fn verify(&self, challenge: &AuthChallenge, context: &[u8], signature: &Signature) -> bool {
+    pub fn verify(
+        &self,
+        challenge: &AuthChallenge,
+        context: SigningContext,
+        signature: &Signature,
+    ) -> bool {
        let challenge = challenge.format();
        self.0
-            .verify_with_context(&challenge, context, &signature.0)
+            .verify_with_context(&challenge, context.as_bytes(), &signature.0)
+    }
+
+    #[must_use]
+    pub fn verify_message(
+        &self,
+        message: &[u8],
+        context: SigningContext,
+        signature: &Signature,
+    ) -> bool {
+        self.0
+            .verify_with_context(message, context.as_bytes(), &signature.0)
    }
 }

@@ -115,17 +147,21 @@ impl SigningKey {
        self.0.verifying_key().into()
    }

-    pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
+    pub fn sign_message(
+        &self,
+        message: &[u8],
+        context: SigningContext,
+    ) -> Result<Signature, Error> {
        self.0
            .signing_key()
-            .sign_deterministic(message, context)
+            .sign_deterministic(message, context.as_bytes())
            .map(Into::into)
    }

    pub fn sign_challenge(
        &self,
        challenge: &AuthChallenge,
-        context: &[u8],
+        context: SigningContext,
    ) -> Result<Signature, Error> {
        let challenge = challenge.format();

@@ -192,7 +228,7 @@ mod tests {

    use crate::authn::AuthChallenge;

-    use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
+    use super::{PublicKey, Signature, SigningContext, SigningKey};

    #[test]
    fn public_key_round_trip_decodes() {
@@ -208,7 +244,7 @@ mod tests {
    fn signature_round_trip_decodes() {
        let key = SigningKey::generate();
        let signature = key
-            .sign_message(b"challenge", CLIENT_CONTEXT)
+            .sign_message(b"challenge", SigningContext::Client)
            .expect("signature should be created");

        let decoded =
@@ -223,11 +259,11 @@ mod tests {
        let public_key = key.public_key();
        let challenge = AuthChallenge::generate(&mut rand::rng());
        let signature = key
-            .sign_challenge(&challenge, CLIENT_CONTEXT)
+            .sign_challenge(&challenge, SigningContext::Client)
            .expect("signature should be created");

-        assert!(public_key.verify(&challenge, CLIENT_CONTEXT, &signature));
-        assert!(!public_key.verify(&challenge, OPERATOR_CONTEXT, &signature));
+        assert!(public_key.verify(&challenge, SigningContext::Client, &signature));
+        assert!(!public_key.verify(&challenge, SigningContext::Operator, &signature));
    }

    #[test]
@@ -240,13 +276,13 @@ mod tests {
        let challenge = AuthChallenge::generate(&mut rand::rng());

        let signature = restored
-            .sign_challenge(&challenge, CLIENT_CONTEXT)
+            .sign_challenge(&challenge, SigningContext::Client)
            .expect("signature should be created");

        assert!(
            restored
                .public_key()
-                .verify(&challenge, CLIENT_CONTEXT, &signature)
+                .verify(&challenge, SigningContext::Client, &signature)
        );
    }
 }
--- a/server/crates/arbiter-crypto/src/safecell.rs
+++ b/server/crates/arbiter-crypto/src/safecell.rs
@@ -22,7 +22,7 @@ pub trait SafeCellHandle<T> {
    fn read(&mut self) -> Self::CellRead<'_>;
    fn write(&mut self) -> Self::CellWrite<'_>;

-    fn new_inline<F>(f: F) -> Self
+    fn new_inline_default<F>(f: F) -> Self
    where
        Self: Sized,
        T: Default,
@@ -36,6 +36,14 @@ pub trait SafeCellHandle<T> {
        cell
    }

+    fn new_inline<F>(f: Box<F>) -> Self
+    where
+        Self: Sized,
+        F: for<'a> FnOnce() -> T,
+    {
+        Self::new(f())
+    }
+
    #[inline(always)]
    fn read_inline<F, R>(&mut self, f: F) -> R
    where
--- a/server/crates/arbiter-proto/src/lib.rs
+++ b/server/crates/arbiter-proto/src/lib.rs
@@ -23,6 +23,10 @@ pub mod proto {
            tonic::include_proto!("arbiter.operator.evm");
        }

+        pub mod governance {
+            tonic::include_proto!("arbiter.operator.governance");
+        }
+
        pub mod sdk_client {
            tonic::include_proto!("arbiter.operator.sdk_client");
        }
@@ -34,6 +38,10 @@ pub mod proto {
                tonic::include_proto!("arbiter.operator.vault.bootstrap");
            }

+            pub mod rekey {
+                tonic::include_proto!("arbiter.operator.vault.rekey");
+            }
+
            pub mod unseal {
                tonic::include_proto!("arbiter.operator.vault.unseal");
            }
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -37,11 +37,12 @@ kameo.workspace = true
 chacha20poly1305 = { version = "0.10.1", features = ["std"] }
 argon2 = { version = "0.5.3", features = ["zeroize"] }
 restructed = "0.2.2"
-strum = { version = "0.28.0", features = ["derive"] }
+strum.workspace = true
 pem = "3.0.6"
 sha2.workspace = true
 hmac.workspace = true
 alloy.workspace = true
+prost.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
 anyhow = "1.0.102"
@@ -50,6 +51,8 @@ subtle = "2.6.1"
 x25519-dalek.workspace = true
 k256.workspace = true
 kameo_actors.workspace = true
+vsss-rs = "5.4.0"
+rand_core = "0.6"

 [dev-dependencies]
 proptest = "1.11.0"
--- a/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
@@ -56,6 +56,7 @@ create table if not exists operator (

    share blob not null,
    share_nonce blob not null,
+    share_salt blob not null,

    created_at integer not null default(unixepoch ('now')),
    updated_at integer not null default(unixepoch ('now'))
@@ -215,3 +216,156 @@ create table if not exists integrity_envelope (
 ) STRICT;

 create unique index if not exists uniq_integrity_envelope_entity on integrity_envelope (entity_kind, entity_id);
+
+create table if not exists proposal (
+    id           integer not null primary key,
+    kind         text    not null,
+    initiator_id integer not null references operator_identity(id) on delete restrict,
+    created_at   integer not null default(unixepoch('now')),
+    expires_at   integer not null,
+    status       text    not null default 'pending'
+        check (status in ('pending', 'approved', 'rejected'))
+) STRICT;
+
+-- Parameters of an approved-or-pending proposal
+create table if not exists proposal_approve_sdk_client (
+    proposal_id integer not null primary key references proposal(id) on delete cascade,
+    client_id   integer not null references program_client(id) on delete restrict
+) STRICT;
+
+create table if not exists proposal_grant_wallet_access (
+    proposal_id integer not null primary key references proposal(id) on delete cascade,
+    wallet_id   integer not null references evm_wallet(id) on delete restrict,
+    client_id   integer not null references program_client(id) on delete restrict
+) STRICT;
+
+create table if not exists proposal_replace_operator (
+    proposal_id     integer not null primary key references proposal(id) on delete cascade,
+    old_operator_id integer not null references operator_identity(id) on delete restrict,
+    new_pubkey      blob    not null
+) STRICT;
+
+-- The transaction an operator votes to sign.
+create table if not exists proposal_one_off_transaction (
+    proposal_id              integer not null primary key references proposal(id) on delete cascade,
+    client_id                integer not null references program_client(id) on delete restrict,
+    wallet_address           blob    not null check (length(wallet_address) = 20),
+    chain_id                 integer not null,
+    nonce                    integer not null,
+    gas_limit                integer not null,
+    max_fee_per_gas          blob    not null check (length(max_fee_per_gas) = 16),
+    max_priority_fee_per_gas blob    not null check (length(max_priority_fee_per_gas) = 16),
+    to_address               blob    not null check (length(to_address) = 20),
+    value                    blob    not null check (length(value) = 32),
+    input                    blob    not null
+) STRICT;
+
+-- The grant an operator votes to creat
+create table if not exists proposal_persistent_grant (
+    proposal_id              integer not null primary key references proposal (id) on delete cascade,
+    wallet_access_id         integer not null references evm_wallet_access (id) on delete restrict,
+    chain_id                 integer not null, -- EIP-155 chain ID
+    valid_from               integer, -- unix timestamp (seconds), null = no lower bound
+    valid_until              integer, -- unix timestamp (seconds), null = no upper bound
+    max_gas_fee_per_gas      blob check (max_gas_fee_per_gas is null or length(max_gas_fee_per_gas) = 32),
+    max_priority_fee_per_gas blob check (max_priority_fee_per_gas is null or length(max_priority_fee_per_gas) = 32),
+    rate_limit_count         integer, -- max transactions in window, null = unlimited
+    rate_limit_window_secs   integer, -- window duration in seconds, null = unlimited
+    check ((rate_limit_count is null) = (rate_limit_window_secs is null))
+) STRICT;
+
+-- `specific = ether_transfer`
+create table if not exists proposal_persistent_grant_ether (
+    proposal_id integer not null primary key references proposal_persistent_grant (proposal_id) on delete cascade,
+    window_secs integer not null,
+    max_volume  blob    not null check (length(max_volume) = 32)
+) STRICT;
+
+create table if not exists proposal_persistent_grant_ether_target (
+    id          integer not null primary key,
+    proposal_id integer not null references proposal_persistent_grant_ether (proposal_id) on delete cascade,
+    address     blob    not null check (length(address) = 20)
+) STRICT;
+
+create unique index if not exists uniq_proposal_ether_target on proposal_persistent_grant_ether_target (proposal_id, address);
+
+-- `specific = token_transfer`
+create table if not exists proposal_persistent_grant_token (
+    proposal_id    integer not null primary key references proposal_persistent_grant (proposal_id) on delete cascade,
+    token_contract blob    not null check (length(token_contract) = 20),
+    receiver       blob check (receiver is null or length(receiver) = 20)
+) STRICT;
+
+create table if not exists proposal_persistent_grant_token_limit (
+    id          integer not null primary key,
+    proposal_id integer not null references proposal_persistent_grant_token (proposal_id) on delete cascade,
+    window_secs integer not null,
+    max_volume  blob    not null check (length(max_volume) = 32)
+) STRICT;
+
+create table if not exists proposal_vote (
+    id          integer not null primary key,
+    proposal_id integer not null references proposal(id) on delete cascade,
+    operator_id integer not null references operator_identity(id) on delete restrict,
+    approve     integer not null check (approve in (0, 1)),
+    signature   blob    not null,
+    voted_at    integer not null default(unixepoch('now')),
+    unique (proposal_id, operator_id)
+) STRICT;
+
+
+-- The signature the vault produced for an approved transaction, by component.
+--
+-- secp256k1 signatures have three common encodings (Electrum v=27/28, raw parity,
+-- ERC-2098 compact); a single blob would not say which one it holds. `y_parity` is
+-- the raw bit -- add 27 to rebuild the Electrum form `Signature::as_bytes` emits.
+create table if not exists proposal_one_off_transaction_result (
+    proposal_id integer not null primary key
+        references proposal_one_off_transaction (proposal_id) on delete cascade,
+    r           blob    not null check (length(r) = 32),
+    s           blob    not null check (length(s) = 32),
+    y_parity    integer not null check (y_parity in (0, 1)),
+    created_at  integer not null default(unixepoch('now'))
+) STRICT;
+
+-- ===============================
+-- Recovery Operators (§3.4/§3.5/§3.6)
+-- ===============================
+
+-- Encrypted Shamir shares for recovery operators (mirrors the `operator` table).
+create table if not exists recovery_operator (
+    id          integer not null primary key references recovery_operator_identity(id) on delete restrict,
+    share       blob    not null,
+    share_nonce blob    not null,
+    share_salt  blob    not null,
+    created_at  integer not null default(unixepoch('now')),
+    updated_at  integer not null default(unixepoch('now'))
+) STRICT;
+
+create table if not exists recovery_operator_identity (
+    id         integer not null primary key,
+    public_key blob    not null unique,
+    created_at integer not null default(unixepoch('now')),
+    updated_at integer not null default(unixepoch('now'))
+) STRICT;
+
+-- One active wakeup request at a time. A request is pending when cancelled_at IS NULL
+-- and requested_at + 14 days > now. It becomes active (recovery live) after 14 days.
+create table if not exists recovery_wakeup_request (
+    id           integer not null primary key,
+    requested_by integer not null references operator_identity(id) on delete restrict,
+    requested_at integer not null default(unixepoch('now')),
+    cancelled_by integer references operator_identity(id) on delete restrict,
+    cancelled_at integer
+) STRICT;
+
+-- Votes cast by recovery operators; only allowed on replace_operator proposals.
+create table if not exists recovery_proposal_vote (
+    id                   integer not null primary key,
+    proposal_id          integer not null references proposal(id) on delete cascade,
+    recovery_operator_id integer not null references recovery_operator_identity(id) on delete restrict,
+    approve              integer not null check (approve in (0, 1)),
+    signature            blob    not null,
+    voted_at             integer not null default(unixepoch('now')),
+    unique (proposal_id, recovery_operator_id)
+) STRICT;
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -160,29 +160,23 @@ impl EvmActor {
    }

    #[message]
-    #[expect(clippy::unused_async, reason = "reserved for impl")]
-    pub async fn operator_delete_grant(&mut self, _grant_id: i32) -> Result<(), Error> {
-        // let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        // let vault = self.vault.clone();
+    pub async fn operator_delete_grant(&mut self, grant_id: i32) -> Result<(), Error> {
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;

-        // diesel_async::AsyncConnection::transaction(&mut conn, |conn| {
-        //     Box::pin(async move {
-        //         diesel::update(schema::evm_basic_grant::table)
-        //             .filter(schema::evm_basic_grant::id.eq(grant_id))
-        //             .set(schema::evm_basic_grant::revoked_at.eq(SqliteTimestamp::now()))
-        //             .execute(conn)
-        //             .await?;
+        let affected = diesel::update(schema::evm_basic_grant::table)
+            .filter(schema::evm_basic_grant::id.eq(grant_id))
+            .set(schema::evm_basic_grant::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
+            .await
+            .map_err(DatabaseError::from)?;

-        //         let signed = integrity::evm::load_signed_grant_by_basic_id(conn, grant_id).await?;
+        if affected == 0 {
+            return Err(Error::Database(DatabaseError::from(
+                diesel::result::Error::NotFound,
+            )));
+        }

-        //         diesel::result::QueryResult::Ok(())
-        //     })
-        // })
-        // .await
-        // .map_err(DatabaseError::from)?;
-
-        // Ok(())
-        todo!()
+        Ok(())
    }

    #[message]
--- a/server/crates/arbiter-server/src/actors/mod.rs
+++ b/server/crates/arbiter-server/src/actors/mod.rs
@@ -1,7 +1,8 @@
 use crate::{
    actors::{
        bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
-        operator_registry::OperatorRegistry, vault::Vault,
+        operator_registry::OperatorRegistry, proposal_manager::ProposalManager, vault::Vault,
+        vault_coordinator::VaultCoordinator,
    },
    db,
 };
@@ -14,7 +15,9 @@ pub mod bootstrap;
 pub mod evm;
 pub mod flow_coordinator;
 pub mod operator_registry;
+pub mod proposal_manager;
 pub mod vault;
+pub mod vault_coordinator;

 #[derive(Error, Debug)]
 pub enum SpawnError {
@@ -30,9 +33,11 @@ pub enum SpawnError {
 pub struct GlobalActors {
    pub vault: ActorRef<Vault>,
    pub bootstrapper: ActorRef<Bootstrapper>,
+    pub vault_coordinator: ActorRef<VaultCoordinator>,
    pub flow_coordinator: ActorRef<FlowCoordinator>,
    pub operator_registry: ActorRef<OperatorRegistry>,
    pub evm: ActorRef<EvmActor>,
+    pub proposal_manager: ActorRef<ProposalManager>,
    pub events: ActorRef<MessageBus>,
 }

@@ -45,15 +50,27 @@ impl GlobalActors {
        let message_bus = Self::spawn_message_bus();
        let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?);
        let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
+        let evm = EvmActor::spawn(EvmActor::new(key_holder.clone(), db.clone()));
+        let vault_coordinator = VaultCoordinator::spawn(VaultCoordinator::new(
+            db.clone(),
+            key_holder.clone(),
+        ));
        Ok(Self {
            bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
-            evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
+            proposal_manager: ProposalManager::spawn(ProposalManager::new(
+                db,
+                key_holder.clone(),
+                evm.clone(),
+                vault_coordinator.clone(),
+            )),
            vault: key_holder,
+            vault_coordinator,
            flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::new(
                operator_registry.clone(),
            )),
            operator_registry,
            events: message_bus,
+            evm,
        })
    }
 }
--- a/server/crates/arbiter-server/src/actors/proposal_manager.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager.rs
@@ -0,0 +1,789 @@
+use crate::{
+    actors::{
+        evm::EvmActor,
+        vault::Vault,
+        vault_coordinator::{StartRekey, VaultCoordinator},
+    },
+    crypto::governance,
+    db::{
+        self,
+        functions::unixepoch,
+        models::{
+            NewProposal, NewProposalVote, NewRecoveryProposalVote, NewRecoveryWakeupRequest,
+            OperatorIdentityId, Proposal, ProposalId, ProposalStatus, RecoveryOperatorIdentityId,
+            SqliteTimestamp,
+        },
+        proposal::{ProposalKind, ProposalKindTag, one_off_transaction, persistent_grant},
+        schema,
+    },
+};
+use chrono::Utc;
+use diesel::{
+    ExpressionMethods as _, QueryDsl,
+    dsl::{exists, select},
+};
+use diesel_async::{AsyncConnection as _, RunQueryDsl};
+use kameo::{Actor, actor::ActorRef, messages};
+use std::collections::HashMap;
+use strum::IntoDiscriminant as _;
+use tracing::{error, warn};
+
+pub const DEFAULT_TTL_SECS: u32 = 7 * 24 * 60 * 60; // 7 days
+pub const MAX_TTL_SECS: u32 = DEFAULT_TTL_SECS;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum VoteOutcome {
+    Pending,
+    Approved,
+    Rejected,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Proposal not found")]
+    ProposalNotFound,
+    #[error("Proposal is not pending")]
+    ProposalNotPending,
+    #[error("Proposal has expired")]
+    ProposalExpired,
+    #[error("Requested TTL exceeds the maximum of {} seconds", MAX_TTL_SECS)]
+    TtlTooLong,
+    #[error("Operator already voted on this proposal")]
+    AlreadyVoted,
+    #[error("Invalid vote signature")]
+    InvalidSignature,
+    #[error("Operator not found")]
+    OperatorNotFound,
+    #[error("Database connection error: {0}")]
+    DatabaseConnection(#[from] db::PoolError),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Execution failed: {0}")]
+    ExecutionFailed(String),
+    #[error("Recovery operators are sleeping")]
+    RecoveryNotActive,
+    #[error("Recovery operators may only vote on operator replacement")]
+    NotAllowedForRecoveryOperator,
+    #[error("A recovery wake-up is already pending or active")]
+    WakeupAlreadyPending,
+    #[error("No active recovery wake-up to cancel")]
+    NoActiveWakeup,
+}
+
+#[derive(Debug)]
+pub struct ProposalSummary {
+    pub id: ProposalId,
+    pub kind: ProposalKindTag,
+    pub initiator_id: OperatorIdentityId,
+    pub expires_at: SqliteTimestamp,
+    pub approve_count: i64,
+    pub reject_count: i64,
+}
+
+#[derive(Actor)]
+pub struct ProposalManager {
+    pub(crate) db: db::DatabasePool,
+    pub(crate) vault: ActorRef<Vault>,
+    pub(crate) evm: ActorRef<EvmActor>,
+    pub(crate) vault_coordinator: ActorRef<VaultCoordinator>,
+}
+
+impl ProposalManager {
+    pub const fn new(
+        db: db::DatabasePool,
+        vault: ActorRef<Vault>,
+        evm: ActorRef<EvmActor>,
+        vault_coordinator: ActorRef<VaultCoordinator>,
+    ) -> Self {
+        Self {
+            db,
+            vault,
+            evm,
+            vault_coordinator,
+        }
+    }
+}
+
+#[messages]
+impl ProposalManager {
+    #[message]
+    pub async fn create_proposal(
+        &mut self,
+        kind: ProposalKind,
+        initiator_id: OperatorIdentityId,
+        ttl_secs: Option<u32>,
+    ) -> Result<ProposalId, Error> {
+        let ttl = ttl_secs.unwrap_or(DEFAULT_TTL_SECS);
+        if ttl > MAX_TTL_SECS {
+            return Err(Error::TtlTooLong);
+        }
+        let expires_at =
+            SqliteTimestamp::from(Utc::now() + chrono::Duration::seconds(i64::from(ttl)));
+
+        let id: ProposalId = self
+            .db
+            .get()
+            .await?
+            .transaction(async |conn| {
+                let id: ProposalId = diesel::insert_into(schema::proposal::table)
+                    .values(&NewProposal {
+                        kind: kind.discriminant(),
+                        initiator_id,
+                        expires_at,
+                    })
+                    .returning(schema::proposal::id)
+                    .get_result(conn)
+                    .await?;
+                db::proposal::insert_kind(conn, id, &kind).await?;
+                Ok::<_, diesel::result::Error>(id)
+            })
+            .await?;
+
+        Ok(id)
+    }
+
+    #[message]
+    pub async fn query_pending(&mut self, operator_id: OperatorIdentityId) -> Vec<ProposalSummary> {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::as_conversions,
+            reason = "fixme! #84; this will break in 2038"
+        )]
+        let now_ts = Utc::now().timestamp() as i32;
+
+        let Ok(mut conn) = self.db.get().await else {
+            warn!("query_pending: failed to acquire DB connection");
+            return vec![];
+        };
+
+        let voted_ids: Vec<ProposalId> = schema::proposal_vote::table
+            .filter(schema::proposal_vote::operator_id.eq(operator_id))
+            .select(schema::proposal_vote::proposal_id)
+            .load(&mut conn)
+            .await
+            .unwrap_or_default();
+
+        let proposals: Vec<Proposal> = schema::proposal::table
+            .filter(schema::proposal::status.eq(ProposalStatus::Pending))
+            .filter(schema::proposal::expires_at.gt(now_ts))
+            .filter(diesel::dsl::not(schema::proposal::id.eq_any(&voted_ids)))
+            .load(&mut conn)
+            .await
+            .unwrap_or_default();
+
+        let ids: Vec<ProposalId> = proposals.iter().map(|p| p.id).collect();
+        let tallies: Vec<(ProposalId, bool, i64)> = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq_any(&ids))
+            .group_by((
+                schema::proposal_vote::proposal_id,
+                schema::proposal_vote::approve,
+            ))
+            .select((
+                schema::proposal_vote::proposal_id,
+                schema::proposal_vote::approve,
+                diesel::dsl::count_star(),
+            ))
+            .load(&mut conn)
+            .await
+            .unwrap_or_default();
+
+        let mut by_proposal: HashMap<ProposalId, (i64, i64)> = HashMap::new();
+        for (proposal_id, approve, count) in tallies {
+            let entry = by_proposal.entry(proposal_id).or_insert((0, 0));
+            if approve {
+                entry.0 += count;
+            } else {
+                entry.1 += count;
+            }
+        }
+
+        proposals
+            .into_iter()
+            .map(|p| {
+                let (approve_count, reject_count) =
+                    by_proposal.get(&p.id).copied().unwrap_or((0, 0));
+                ProposalSummary {
+                    id: p.id,
+                    kind: p.kind,
+                    initiator_id: p.initiator_id,
+                    expires_at: p.expires_at,
+                    approve_count,
+                    reject_count,
+                }
+            })
+            .collect()
+    }
+
+    #[message]
+    pub async fn cast_vote(
+        &mut self,
+        proposal_id: ProposalId,
+        operator_id: OperatorIdentityId,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<VoteOutcome, Error> {
+        let mut conn = self.db.get().await?;
+
+        // Load proposal — must exist
+        let proposal: Proposal = schema::proposal::table
+            .find(proposal_id)
+            .first(&mut conn)
+            .await
+            .map_err(|e| match e {
+                diesel::result::Error::NotFound => Error::ProposalNotFound,
+                other => Error::DatabaseQuery(other),
+            })?;
+
+        // Check for duplicate vote before status check so AlreadyVoted takes priority
+        let already_voted: bool = select(exists(
+            schema::proposal_vote::table
+                .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+                .filter(schema::proposal_vote::operator_id.eq(operator_id)),
+        ))
+        .get_result(&mut conn)
+        .await?;
+        if already_voted {
+            return Err(Error::AlreadyVoted);
+        }
+
+        if proposal.status != ProposalStatus::Pending {
+            return Err(Error::ProposalNotPending);
+        }
+
+        if proposal.expires_at.0 <= Utc::now() {
+            return Err(Error::ProposalExpired);
+        }
+
+        // Load operator public key from operator_identity
+        let pubkey_bytes: Vec<u8> = schema::operator_identity::table
+            .find(operator_id)
+            .select(schema::operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(|e| match e {
+                diesel::result::Error::NotFound => Error::OperatorNotFound,
+                other => Error::DatabaseQuery(other),
+            })?;
+
+        governance::verify_vote(&pubkey_bytes, proposal_id, approve, &signature)
+            .map_err(|_| Error::InvalidSignature)?;
+
+        // Insert vote
+        diesel::insert_into(schema::proposal_vote::table)
+            .values(&NewProposalVote {
+                proposal_id,
+                operator_id,
+                approve,
+                signature,
+            })
+            .execute(&mut conn)
+            .await?;
+
+        // Quorum check
+        let total_operators: i64 = schema::operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_active = Self::is_recovery_active_conn(&mut conn).await?;
+        let total_recovery: i64 = if recovery_active {
+            schema::recovery_operator_identity::table
+                .count()
+                .get_result(&mut conn)
+                .await?
+        } else {
+            0
+        };
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::cast_sign_loss,
+            clippy::as_conversions,
+            reason = "operator count is always a small positive integer"
+        )]
+        let threshold = if proposal.kind.requires_full_quorum() {
+            // §3.3: key-rotation proposals require every eligible voter to approve
+            // §3.5: when recovery is active, recovery operators also vote on replace_operator
+            (total_operators + total_recovery) as usize
+        } else {
+            crate::crypto::shamir::shamir_threshold(total_operators as usize)
+        };
+
+        let ordinary_approve: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_approve: i64 = schema::recovery_proposal_vote::table
+            .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::recovery_proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let approve_count = ordinary_approve + recovery_approve;
+
+        let ordinary_reject: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_reject: i64 = schema::recovery_proposal_vote::table
+            .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::recovery_proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let reject_count = ordinary_reject + recovery_reject;
+
+        #[expect(
+            clippy::cast_possible_wrap,
+            clippy::as_conversions,
+            reason = "threshold is derived from operator count, always fits i64"
+        )]
+        let threshold_i64 = threshold as i64;
+
+        if approve_count >= threshold_i64 {
+            diesel::update(schema::proposal::table.find(proposal_id))
+                .set(schema::proposal::status.eq(ProposalStatus::Approved))
+                .execute(&mut conn)
+                .await?;
+            drop(conn); // release connection before async execution
+            self.execute_proposal(&proposal).await?;
+            return Ok(VoteOutcome::Approved);
+        }
+
+        let total_eligible = total_operators + total_recovery;
+        if reject_count > total_eligible - threshold_i64 {
+            diesel::update(schema::proposal::table.find(proposal_id))
+                .set(schema::proposal::status.eq(ProposalStatus::Rejected))
+                .execute(&mut conn)
+                .await?;
+            return Ok(VoteOutcome::Rejected);
+        }
+
+        Ok(VoteOutcome::Pending)
+    }
+
+    /// §3.6: Any ordinary operator may request recovery wake-up.
+    /// Fails if a wake-up is already pending or active.
+    #[message]
+    pub async fn request_recovery_wakeup(
+        &mut self,
+        operator_id: OperatorIdentityId,
+    ) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        if Self::has_uncancelled_wakeup(&mut conn).await? {
+            return Err(Error::WakeupAlreadyPending);
+        }
+        diesel::insert_into(schema::recovery_wakeup_request::table)
+            .values(&NewRecoveryWakeupRequest {
+                requested_by: operator_id,
+            })
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    /// §3.6: Any ordinary operator may cancel a pending wake-up request.
+    /// Fails if there is no uncancelled request.
+    #[message]
+    pub async fn cancel_recovery_wakeup(
+        &mut self,
+        operator_id: OperatorIdentityId,
+    ) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        let rows_updated = diesel::update(schema::recovery_wakeup_request::table)
+            .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
+            .set((
+                schema::recovery_wakeup_request::cancelled_by.eq(Some(operator_id)),
+                schema::recovery_wakeup_request::cancelled_at.eq(Some(SqliteTimestamp::now())),
+            ))
+            .execute(&mut conn)
+            .await?;
+        if rows_updated == 0 {
+            return Err(Error::NoActiveWakeup);
+        }
+        Ok(())
+    }
+
+    /// §3.5: Recovery operators may only vote on operator replacement proposals.
+    /// §3.6: Voting is gated behind recovery being active (14-day window elapsed).
+    #[message]
+    pub async fn cast_recovery_vote(
+        &mut self,
+        proposal_id: ProposalId,
+        recovery_operator_id: RecoveryOperatorIdentityId,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<VoteOutcome, Error> {
+        let mut conn = self.db.get().await?;
+
+        let proposal: Proposal = schema::proposal::table
+            .find(proposal_id)
+            .first(&mut conn)
+            .await
+            .map_err(|e| match e {
+                diesel::result::Error::NotFound => Error::ProposalNotFound,
+                other => Error::DatabaseQuery(other),
+            })?;
+
+        if proposal.kind != ProposalKindTag::ReplaceOperator {
+            return Err(Error::NotAllowedForRecoveryOperator);
+        }
+
+        if !Self::is_recovery_active_conn(&mut conn).await? {
+            return Err(Error::RecoveryNotActive);
+        }
+
+        let already_voted: bool = select(exists(
+            schema::recovery_proposal_vote::table
+                .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
+                .filter(
+                    schema::recovery_proposal_vote::recovery_operator_id.eq(recovery_operator_id),
+                ),
+        ))
+        .get_result(&mut conn)
+        .await?;
+        if already_voted {
+            return Err(Error::AlreadyVoted);
+        }
+
+        if proposal.status != ProposalStatus::Pending {
+            return Err(Error::ProposalNotPending);
+        }
+
+        if proposal.expires_at.0 <= Utc::now() {
+            return Err(Error::ProposalExpired);
+        }
+
+        let pubkey_bytes: Vec<u8> = schema::recovery_operator_identity::table
+            .find(recovery_operator_id)
+            .select(schema::recovery_operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(|e| match e {
+                diesel::result::Error::NotFound => Error::OperatorNotFound,
+                other => Error::DatabaseQuery(other),
+            })?;
+
+        governance::verify_vote(&pubkey_bytes, proposal_id, approve, &signature)
+            .map_err(|_| Error::InvalidSignature)?;
+
+        diesel::insert_into(schema::recovery_proposal_vote::table)
+            .values(&NewRecoveryProposalVote {
+                proposal_id,
+                recovery_operator_id,
+                approve,
+                signature,
+            })
+            .execute(&mut conn)
+            .await?;
+
+        // Quorum: all ordinary + all recovery operators must approve (§3.3 + §3.5)
+        let total_ordinary: i64 = schema::operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let total_recovery: i64 = schema::recovery_operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let threshold_i64 = total_ordinary + total_recovery;
+
+        let ordinary_approve: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_approve: i64 = schema::recovery_proposal_vote::table
+            .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::recovery_proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let approve_count = ordinary_approve + recovery_approve;
+
+        if approve_count >= threshold_i64 {
+            diesel::update(schema::proposal::table.find(proposal_id))
+                .set(schema::proposal::status.eq(ProposalStatus::Approved))
+                .execute(&mut conn)
+                .await?;
+            drop(conn);
+            self.execute_proposal(&proposal).await?;
+            return Ok(VoteOutcome::Approved);
+        }
+
+        let recovery_reject: i64 = schema::recovery_proposal_vote::table
+            .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::recovery_proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let ordinary_reject: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
+            .filter(schema::proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let reject_count = ordinary_reject + recovery_reject;
+
+        if reject_count > threshold_i64 - approve_count - reject_count {
+            diesel::update(schema::proposal::table.find(proposal_id))
+                .set(schema::proposal::status.eq(ProposalStatus::Rejected))
+                .execute(&mut conn)
+                .await?;
+            return Ok(VoteOutcome::Rejected);
+        }
+
+        Ok(VoteOutcome::Pending)
+    }
+}
+
+impl ProposalManager {
+    const WAKEUP_DELAY_SECS: i32 = 14 * 24 * 60 * 60;
+
+    /// Returns true when an uncancelled wakeup request has passed the 14-day dispute window.
+    async fn is_recovery_active_conn(conn: &mut db::DatabaseConnection) -> Result<bool, Error> {
+        select(exists(
+            schema::recovery_wakeup_request::table
+                .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
+                .filter(
+                    schema::recovery_wakeup_request::requested_at
+                        .le(unixepoch("now") - Self::WAKEUP_DELAY_SECS),
+                ),
+        ))
+        .get_result(conn)
+        .await
+        .map_err(Error::from)
+    }
+
+    /// Returns true when there is any uncancelled wakeup request (pending or active).
+    async fn has_uncancelled_wakeup(conn: &mut db::DatabaseConnection) -> Result<bool, Error> {
+        select(exists(schema::recovery_wakeup_request::table.filter(
+            schema::recovery_wakeup_request::cancelled_at.is_null(),
+        )))
+        .get_result(conn)
+        .await
+        .map_err(Error::from)
+    }
+
+    async fn execute_proposal(&self, proposal: &Proposal) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        let kind = db::proposal::load_kind(&mut conn, proposal.id, proposal.kind).await?;
+        drop(conn);
+
+        match kind {
+            ProposalKind::ApproveSdkClient(s) => self.execute_approve_sdk_client(s.client_id).await,
+            ProposalKind::GrantWalletAccess(s) => {
+                self.execute_grant_wallet_access(s.wallet_id, s.client_id)
+                    .await
+            }
+            ProposalKind::ReplaceOperator(s) => {
+                self.execute_replace_operator(s.old_operator_id, s.new_pubkey)
+                    .await
+            }
+            ProposalKind::TriggerRekey => self.execute_trigger_rekey().await,
+            ProposalKind::ApprovePersistentGrant(grant) => {
+                self.execute_approve_persistent_grant(*grant).await
+            }
+            ProposalKind::ApproveOneOffTransaction(tx) => {
+                self.execute_approve_one_off_transaction(proposal.id, *tx)
+                    .await
+            }
+        }
+    }
+
+    async fn execute_grant_wallet_access(
+        &self,
+        wallet_id: i32,
+        client_id: i32,
+    ) -> Result<(), Error> {
+        use crate::db::models::EvmWalletId;
+
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+
+        diesel::insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(EvmWalletId::from_raw(wallet_id)),
+                schema::evm_wallet_access::client_id.eq(client_id),
+            ))
+            .execute(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("grant wallet access: {e}")))?;
+
+        Ok(())
+    }
+
+    /// Updates the old operator's public key in-place (preserving their DB id and history),
+    /// removes their old Shamir share, then begins a coordinated re-key (§3.3).
+    async fn execute_replace_operator(
+        &self,
+        old_operator_id: OperatorIdentityId,
+        new_pubkey: Vec<u8>,
+    ) -> Result<(), Error> {
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+
+        diesel::update(schema::operator_identity::table)
+            .filter(schema::operator_identity::id.eq(old_operator_id))
+            .set(schema::operator_identity::public_key.eq(&new_pubkey))
+            .execute(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("update operator pubkey: {e}")))?;
+
+        // Remove the old Shamir share; finalize_rekey will store a fresh one.
+        diesel::delete(schema::operator::table)
+            .filter(schema::operator::id.eq(Some(old_operator_id)))
+            .execute(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("remove old operator share: {e}")))?;
+
+        drop(conn);
+
+        self.vault_coordinator
+            .ask(StartRekey {})
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("start rekey: {e}")))?;
+
+        Ok(())
+    }
+
+    /// Triggers a Shamir re-key with the current operator set (§3.3).
+    async fn execute_trigger_rekey(&self) -> Result<(), Error> {
+        self.vault_coordinator
+            .ask(StartRekey {})
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("start rekey: {e}")))?;
+        Ok(())
+    }
+
+    async fn execute_approve_one_off_transaction(
+        &self,
+        proposal_id: ProposalId,
+        tx: one_off_transaction::Settings,
+    ) -> Result<(), Error> {
+        use crate::actors::evm::ClientSignTransaction;
+        use alloy::{
+            consensus::TxEip1559,
+            eips::eip2930::AccessList,
+            primitives::{Address, Bytes, TxKind, U256},
+        };
+
+        let transaction = TxEip1559 {
+            chain_id: tx.chain_id,
+            nonce: tx.nonce,
+            gas_limit: tx.gas_limit,
+            max_fee_per_gas: tx.max_fee_per_gas,
+            max_priority_fee_per_gas: tx.max_priority_fee_per_gas,
+            to: TxKind::Call(Address::from(tx.to)),
+            value: U256::from_be_bytes(tx.value),
+            input: Bytes::from(tx.input),
+            access_list: AccessList::default(),
+        };
+
+        let sig = self
+            .evm
+            .ask(ClientSignTransaction {
+                client_id: tx.client_id,
+                wallet_address: Address::from(tx.wallet_address),
+                transaction,
+            })
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("sign one-off tx: {e}")))?;
+
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+        one_off_transaction::store_signature(proposal_id, &sig, &mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("store proposal result: {e}")))?;
+
+        Ok(())
+    }
+
+    async fn execute_approve_persistent_grant(
+        &self,
+        grant: persistent_grant::Settings,
+    ) -> Result<(), Error> {
+        use crate::{
+            actors::evm::OperatorCreateGrant,
+            evm::policies::{
+                SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit,
+                ether_transfer, token_transfers,
+            },
+        };
+        use alloy::primitives::{Address, U256};
+        use chrono::Duration;
+
+        let volume = |limit: persistent_grant::VolumeLimit| VolumeRateLimit {
+            max_volume: U256::from_be_bytes(limit.max_volume),
+            window: Duration::seconds(limit.window_secs),
+        };
+
+        let basic = SharedGrantSettings {
+            wallet_access_id: grant.wallet_access_id,
+            chain: grant.chain_id,
+            valid_from: grant
+                .valid_from_secs
+                .and_then(|s| chrono::DateTime::from_timestamp(s, 0)),
+            valid_until: grant
+                .valid_until_secs
+                .and_then(|s| chrono::DateTime::from_timestamp(s, 0)),
+            max_gas_fee_per_gas: grant.max_gas_fee_per_gas.map(U256::from_be_bytes),
+            max_priority_fee_per_gas: grant.max_priority_fee_per_gas.map(U256::from_be_bytes),
+            rate_limit: grant.rate_limit.map(|r| TransactionRateLimit {
+                count: r.count,
+                window: Duration::seconds(r.window_secs),
+            }),
+        };
+
+        let grant = match grant.specific {
+            persistent_grant::Specific::EtherTransfer { targets, limit } => {
+                SpecificGrant::EtherTransfer(ether_transfer::Settings {
+                    target: targets.into_iter().map(Address::from).collect(),
+                    limit: volume(limit),
+                })
+            }
+            persistent_grant::Specific::TokenTransfer {
+                token_contract,
+                receiver,
+                volume_limits,
+            } => SpecificGrant::TokenTransfer(token_transfers::Settings {
+                token_contract: Address::from(token_contract),
+                target: receiver.map(Address::from),
+                volume_limits: volume_limits.into_iter().map(volume).collect(),
+            }),
+        };
+
+        self.evm
+            .ask(OperatorCreateGrant { basic, grant })
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("create grant: {e}")))?;
+
+        Ok(())
+    }
+
+    async fn execute_approve_sdk_client(&self, client_id: i32) -> Result<(), Error> {
+        use crate::{crypto::integrity, peers::client::ClientCredentials};
+        use arbiter_crypto::authn;
+
+        let mut conn = self.db.get().await.map_err(Error::DatabaseConnection)?;
+
+        let pubkey_bytes: Vec<u8> = schema::program_client::table
+            .find(client_id)
+            .select(schema::program_client::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(|e| Error::ExecutionFailed(format!("client not found: {e}")))?;
+
+        let pubkey = authn::PublicKey::try_from(pubkey_bytes.as_slice())
+            .map_err(|()| Error::ExecutionFailed("invalid client public key".to_owned()))?;
+
+        let creds = ClientCredentials { pubkey };
+
+        integrity::sign_entity(&mut conn, &self.vault, &creds, client_id)
+            .await
+            .map_err(|e| {
+                error!(?e, "Failed to sign integrity envelope for client");
+                Error::ExecutionFailed(e.to_string())
+            })
+    }
+}
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -1,13 +1,13 @@
 use crate::{
    crypto::{
-        KeyCell, derive_key,
+        KeyCell,
        encryption::v1::{self, Nonce},
        integrity::v1::HmacSha256,
    },
    db::{
        self,
        models::{self, RootKeyHistory, RootKeyHistoryId},
-        schema::{self},
+        schema,
    },
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -90,7 +90,6 @@ pub struct Vault {
    events: ActorRef<MessageBus>,
 }

-#[messages]
 impl Vault {
    pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> {
        let state = {
@@ -113,7 +112,7 @@ impl Vault {
        Ok(Self { db, state, events })
    }

-    // Exclusive transaction to avoid race condtions if multiple vaults write
+    // Exclusive transaction to avoid race conditions if multiple vaults write
    // additional layer of protection against nonce-reuse
    async fn get_new_nonce(
        pool: &db::DatabasePool,
@@ -158,33 +157,37 @@ impl Vault {
            State::Sealed { .. } => Err(Error::Sealed),
        }
    }
+}

+#[messages]
+impl Vault {
    #[message]
-    pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
-        if !matches!(self.state, State::Unbootstrapped) {
+    pub async fn bootstrap(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
+        if !matches!(&self.state, State::Unbootstrapped) {
            return Err(Error::AlreadyBootstrapped);
        }
-        let salt = v1::generate_salt();
-        let mut seal_key = derive_key(seal_key_raw, &salt);
+
        let mut root_key = KeyCell::new_secure_random();

        // Zero nonces are fine because they are one-time
        let root_key_nonce = Nonce::default();
        let data_encryption_nonce = Nonce::default();

-        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| {
-            let root_key_reader = reader.as_slice();
+        // Generate salt (kept for schema compat)
+        let root_key_salt = v1::generate_salt();
+
+        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|rk| {
            seal_key
-                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
+                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, rk.as_slice())
                .map_err(|err| {
                    error!(?err, "Fatal bootstrap error");
                    Error::Encryption(err)
                })
        })?;

+        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
        let mut conn = self.db.get().await?;

-        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
        let root_key_history_id = conn
            .transaction(async |conn| {
                let root_key_history_id = insert_into(schema::root_key_history::table)
@@ -194,7 +197,7 @@ impl Vault {
                        root_key_encryption_nonce: root_key_nonce.to_vec(),
                        data_encryption_nonce: data_encryption_nonce_bytes.clone(),
                        schema_version: 1,
-                        salt: salt.to_vec(),
+                        salt: root_key_salt.to_vec(),
                    })
                    .returning(schema::root_key_history::id)
                    .get_result(&mut *conn)
@@ -223,52 +226,47 @@ impl Vault {
    }

    #[message]
-    pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
+    pub async fn try_unseal(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
        let State::Sealed {
            root_key_history_id,
        } = &self.state
        else {
            return Err(Error::NotBootstrapped);
        };
+        let root_key_history_id = *root_key_history_id;

-        // We don't want to hold connection while doing expensive KDF work
+        // We don't want to hold connection while doing expensive work
        let current_key = {
            let mut conn = self.db.get().await?;
            schema::root_key_history::table
-                .filter(schema::root_key_history::id.eq(*root_key_history_id))
+                .filter(schema::root_key_history::id.eq(root_key_history_id))
                .select(RootKeyHistory::as_select())
                .first(&mut conn)
                .await?
        };

-        let salt = &current_key.salt;
-        let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| {
-            error!("Broken database: invalid salt for root key");
-            Error::BrokenDatabase
-        })?;
-        let mut seal_key = derive_key(seal_key_raw, &salt);
-
-        let mut root_key = SafeCell::new(current_key.ciphertext.clone());
-
        let nonce =
            Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| {
                error!("Broken database: invalid nonce for root key");
                Error::BrokenDatabase
            })?;

+        let mut root_key_bytes = SafeCell::new(current_key.ciphertext.clone());
        seal_key
-            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
+            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key_bytes)
            .map_err(|err| {
                error!(?err, "Failed to unseal root key: invalid seal key");
                Error::InvalidKey
            })?;

+        let root_key = KeyCell::try_from(root_key_bytes).map_err(|()| {
+            error!("Broken database: invalid encryption key size");
+            Error::BrokenDatabase
+        })?;
+
        self.state = State::Unsealed(Unsealed {
            root_key_history_id: current_key.id,
-            root_key: KeyCell::try_from(root_key).map_err(|err| {
-                error!(?err, "Broken database: invalid encryption key size");
-                Error::BrokenDatabase
-            })?,
+            root_key,
        });

        info!("Vault unsealed successfully");
@@ -277,6 +275,77 @@ impl Vault {
        Ok(())
    }

+    /// Re-encrypts the root key with `new_seal_key` and records a new root_key_history row.
+    /// Called after a Shamir re-key so the old seal key is no longer sufficient to unseal.
+    #[message]
+    pub async fn rekey_root_key(&mut self, mut new_seal_key: KeyCell) -> Result<(), Error> {
+        let Unsealed {
+            root_key,
+            root_key_history_id,
+        } = Self::expect_unsealed(&mut self.state)?;
+
+        let new_nonce = Nonce::default();
+        let new_salt = v1::generate_salt();
+
+        let new_ciphertext: Vec<u8> = root_key.0.read_inline(|rk| {
+            new_seal_key
+                .encrypt(&new_nonce, v1::ROOT_KEY_TAG, rk.as_slice())
+                .map_err(|err| {
+                    error!(?err, "Fatal rekey error");
+                    Error::Encryption(err)
+                })
+        })?;
+
+        let data_encryption_nonce = Nonce::default();
+
+        let mut conn = self.db.get().await?;
+        let new_root_key_history_id: i32 = conn
+            .transaction(async |conn| {
+                let new_id = insert_into(schema::root_key_history::table)
+                    .values(&models::NewRootKeyHistory {
+                        ciphertext: new_ciphertext,
+                        tag: v1::ROOT_KEY_TAG.to_vec(),
+                        root_key_encryption_nonce: new_nonce.to_vec(),
+                        data_encryption_nonce: data_encryption_nonce.to_vec(),
+                        schema_version: 1,
+                        salt: new_salt.to_vec(),
+                    })
+                    .returning(schema::root_key_history::id)
+                    .get_result::<i32>(&mut *conn)
+                    .await?;
+
+                update(schema::arbiter_settings::table)
+                    .set(schema::arbiter_settings::root_key_id.eq(new_id))
+                    .execute(&mut *conn)
+                    .await?;
+
+                Result::<_, diesel::result::Error>::Ok(new_id)
+            })
+            .await?;
+
+        *root_key_history_id = RootKeyHistoryId::from_raw(new_root_key_history_id);
+        info!("Vault root key rekeyed successfully");
+        Ok(())
+    }
+
+    #[message]
+    pub async fn seal(&mut self) -> Result<(), Error> {
+        let Unsealed {
+            root_key_history_id,
+            ..
+        } = Self::expect_unsealed(&mut self.state)?;
+
+        self.state = State::Sealed {
+            root_key_history_id: *root_key_history_id,
+        };
+        let _ = self.events.tell(Publish(events::VaultResealed)).await;
+        Ok(())
+    }
+}
+
+// Server-side cryptographic operations
+#[messages]
+impl Vault {
    #[message]
    pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
        let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;
@@ -354,12 +423,10 @@ impl Vault {
            root_key_history_id,
        } = Self::expect_unsealed(&mut self.state)?;

-        let mut hmac = root_key
-            .0
-            .read_inline(|k| match HmacSha256::new_from_slice(k) {
-                Ok(v) => v,
-                Err(_) => unreachable!("HMAC accepts keys of any size"),
-            });
+        let mut hmac = root_key.0.read_inline(|k| {
+            HmacSha256::new_from_slice(k)
+                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
+        });
        hmac.update(&root_key_history_id.to_raw().to_be_bytes());
        hmac.update(&mac_input);

@@ -383,37 +450,20 @@ impl Vault {
            return Ok(false);
        }

-        let mut hmac = root_key
-            .0
-            .read_inline(|k| match HmacSha256::new_from_slice(k) {
-                Ok(v) => v,
-                Err(_) => unreachable!("HMAC accepts keys of any size"),
-            });
+        let mut hmac = root_key.0.read_inline(|k| {
+            HmacSha256::new_from_slice(k)
+                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
+        });
        hmac.update(&key_version.to_raw().to_be_bytes());
        hmac.update(&mac_input);

        Ok(hmac.verify_slice(&expected_mac).is_ok())
    }
-
-    #[message]
-    pub async fn seal(&mut self) -> Result<(), Error> {
-        let Unsealed {
-            root_key_history_id,
-            ..
-        } = Self::expect_unsealed(&mut self.state)?;
-
-        self.state = State::Sealed {
-            root_key_history_id: *root_key_history_id,
-        };
-        let _ = self.events.tell(Publish(events::VaultResealed)).await;
-        Ok(())
-    }
 }

 #[cfg(test)]
 mod tests {
    use crate::actors::GlobalActors;
-    use crate::db::models::RootKeyHistory;
    use arbiter_crypto::safecell::SafeCellHandle as _;

    use super::*;
@@ -422,8 +472,7 @@ mod tests {
        let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
            .await
            .unwrap();
-        let seal_key = SafeCell::new(b"test-seal-key".to_vec());
-        actor.bootstrap(seal_key).await.unwrap();
+        actor.bootstrap(KeyCell::from([0u8; 32])).await.unwrap();
        actor
    }

@@ -432,12 +481,12 @@ mod tests {
    async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
        let db = db::create_test_pool().await;
        let mut actor = bootstrapped_actor(&db).await;
-        let root_key_history_id = match actor.state {
-            State::Unsealed(Unsealed {
-                root_key_history_id,
-                ..
-            }) => root_key_history_id,
-            _ => panic!("expected unsealed state"),
+        let State::Unsealed(Unsealed {
+            root_key_history_id,
+            ..
+        }) = actor.state
+        else {
+            panic!("expected unsealed state");
        };

        let n1 = Vault::get_new_nonce(&db, root_key_history_id)
--- a/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
@@ -0,0 +1,721 @@
+use std::collections::HashMap;
+
+use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+use diesel::{ExpressionMethods as _, QueryDsl};
+use diesel_async::RunQueryDsl;
+use kameo::{Actor, actor::ActorRef, messages};
+use rand_core::{OsRng, RngCore as _};
+use tracing::error;
+
+use crate::{
+    actors::vault::{Bootstrap, RekeyRootKey, TryUnseal, Vault},
+    crypto::{KeyCell, derive_key, encryption::v1::Nonce, shamir, shamir::shamir_threshold},
+    db::{self, models, schema},
+};
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Already coordinating a bootstrap")]
+    AlreadyBootstrapping,
+    #[error("Already coordinating an unseal")]
+    AlreadyUnsealing,
+    #[error("Rekey not in progress")]
+    NotRekeying,
+    #[error("Bootstrap not in progress")]
+    NotBootstrapping,
+    #[error("Unseal not in progress")]
+    NotUnsealing,
+    #[error("Operator already contributed")]
+    DuplicateContribution,
+    #[error("Operator not found in database")]
+    OperatorNotFound,
+    #[error("Invalid passphrase (decryption failed)")]
+    InvalidPassphrase,
+    #[error("Shamir error: {0}")]
+    Shamir(String),
+    #[error("Database connection error: {0}")]
+    DatabaseConnection(#[from] db::PoolError),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Encryption error")]
+    Encryption,
+    #[error("Vault error")]
+    VaultError,
+    #[error("Two-operator vaults require at least one recovery share")]
+    TwoOperatorsRequireRecovery,
+    #[error("Broken database")]
+    BrokenDatabase,
+}
+
+// Passphrases stored as plain Vec<u8> (not SafeCell) so CoordinatorState is Sync.
+// They are ephemeral and dropped immediately after use.
+enum CoordinatorState {
+    Idle,
+    Bootstrapping {
+        declared_count: usize,
+        recovery_count: usize,
+        passphrases: HashMap<i32, Vec<u8>>,
+        recovery_passphrases: HashMap<i32, Vec<u8>>,
+    },
+    Unsealing {
+        threshold: usize,
+        ordinary_passphrases: HashMap<i32, Vec<u8>>,
+        recovery_passphrases: HashMap<i32, Vec<u8>>,
+    },
+    /// Shamir re-key after `replace_operator` or `trigger_rekey` is approved (§3.3).
+    /// Collects new passphrases from all current operators, then generates a fresh seal key,
+    /// re-splits it, and re-encrypts the vault root key.
+    Rekeying {
+        ordinary_count: usize,
+        recovery_count: usize,
+        passphrases: HashMap<i32, Vec<u8>>,
+        recovery_passphrases: HashMap<i32, Vec<u8>>,
+    },
+}
+
+#[derive(Actor)]
+pub struct VaultCoordinator {
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    state: CoordinatorState,
+}
+
+impl VaultCoordinator {
+    pub const fn new(db: db::DatabasePool, vault: ActorRef<Vault>) -> Self {
+        Self {
+            db,
+            vault,
+            state: CoordinatorState::Idle,
+        }
+    }
+}
+
+const SHARE_AAD: &[u8] = b"arbiter/shamir-share/v1";
+
+fn encrypt_share(
+    passphrase_bytes: Vec<u8>,
+    share: &[u8],
+) -> Result<(Vec<u8>, Vec<u8>, Vec<u8>), Error> {
+    let mut share_salt = vec![0u8; 32];
+    OsRng.fill_bytes(&mut share_salt);
+
+    let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+    let mut share_seal_key = derive_key(&mut passphrase_cell, &share_salt);
+
+    let nonce = Nonce::default();
+    let encrypted_share = share_seal_key
+        .encrypt(&nonce, SHARE_AAD, share)
+        .map_err(|_| Error::Encryption)?;
+
+    Ok((encrypted_share, nonce.to_vec(), share_salt))
+}
+
+fn decrypt_share(
+    passphrase_bytes: Vec<u8>,
+    encrypted_share: Vec<u8>,
+    share_nonce_bytes: &[u8],
+    share_salt: &[u8],
+    operator_id: i32,
+) -> Result<Vec<u8>, Error> {
+    let nonce = Nonce::try_from(share_nonce_bytes).map_err(|()| {
+        error!(operator_id, "Invalid nonce in DB");
+        Error::BrokenDatabase
+    })?;
+
+    let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+    let mut share_seal_key = derive_key(&mut passphrase_cell, share_salt);
+
+    let mut share_buffer = SafeCell::new(encrypted_share);
+    share_seal_key
+        .decrypt_in_place(&nonce, SHARE_AAD, &mut share_buffer)
+        .map_err(|_| Error::InvalidPassphrase)?;
+
+    Ok(share_buffer.read().clone())
+}
+
+/// §3.4: Split the seal key across ordinary + recovery operators.
+/// Threshold = `shamir_threshold(ordinary_count)`; total shares = ordinary + recovery.
+/// When `ordinary_count` == 1 (threshold = 1), vsss-rs does not support a proper split,
+/// so each share is the seal key itself — any single participant can reconstruct.
+async fn finalize_bootstrap(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    ordinary_passphrases: HashMap<i32, Vec<u8>>,
+    recovery_passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let ordinary_count = ordinary_passphrases.len();
+    let recovery_count = recovery_passphrases.len();
+    let total = ordinary_count + recovery_count;
+    let threshold = shamir_threshold(ordinary_count);
+
+    let mut seal_key_bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut seal_key_bytes);
+
+    // threshold == 1 means any single share reconstructs the key (degenerate split).
+    // vsss-rs requires threshold >= 2, so we store the key directly in this case.
+    let shares: Vec<Vec<u8>> = if threshold >= 2 {
+        shamir::split_key(threshold, total, &seal_key_bytes, OsRng)
+            .map_err(|e| Error::Shamir(e.to_string()))?
+    } else {
+        std::iter::repeat_with(|| seal_key_bytes.to_vec()).take(total).collect()
+    };
+
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    let mut conn = db.get().await?;
+    let mut shares_iter = shares.into_iter();
+
+    for (operator_id_raw, passphrase_bytes) in ordinary_passphrases {
+        let share = shares_iter
+            .next()
+            .expect("split_key returned enough shares");
+        let (encrypted_share, nonce_bytes, share_salt) = encrypt_share(passphrase_bytes, &share)?;
+
+        diesel::replace_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id_raw)),
+                schema::operator::share.eq(&encrypted_share),
+                schema::operator::share_nonce.eq(&nonce_bytes),
+                schema::operator::share_salt.eq(&share_salt),
+                schema::operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    for (recovery_id_raw, passphrase_bytes) in recovery_passphrases {
+        let share = shares_iter
+            .next()
+            .expect("split_key returned enough shares");
+        let (encrypted_share, nonce_bytes, share_salt) = encrypt_share(passphrase_bytes, &share)?;
+
+        diesel::replace_into(schema::recovery_operator::table)
+            .values((
+                schema::recovery_operator::id.eq(recovery_id_raw),
+                schema::recovery_operator::share.eq(&encrypted_share),
+                schema::recovery_operator::share_nonce.eq(&nonce_bytes),
+                schema::recovery_operator::share_salt.eq(&share_salt),
+                schema::recovery_operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::recovery_operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    vault.ask(Bootstrap { seal_key }).await.map_err(|err| {
+        error!(?err, "Vault bootstrap failed");
+        Error::VaultError
+    })?;
+
+    Ok(())
+}
+
+/// §3.5: Unseal using any threshold-sized mix of ordinary + recovery shares.
+async fn finalize_unseal(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    ordinary_passphrases: HashMap<i32, Vec<u8>>,
+    recovery_passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let mut conn = db.get().await?;
+
+    // Determine whether shares were stored as raw keys (threshold=1) or vsss-rs splits (threshold>=2).
+    let ordinary_operator_count: i64 = schema::operator::table
+        .count()
+        .get_result(&mut conn)
+        .await?;
+    let threshold = shamir_threshold(ordinary_operator_count as usize);
+
+    let mut shares: Vec<Vec<u8>> = Vec::new();
+
+    for (operator_id_raw, passphrase_bytes) in ordinary_passphrases {
+        let (encrypted_share, share_nonce_bytes, share_salt): (Vec<u8>, Vec<u8>, Vec<u8>) =
+            schema::operator::table
+                .filter(schema::operator::id.eq(Some(operator_id_raw)))
+                .select((
+                    schema::operator::share,
+                    schema::operator::share_nonce,
+                    schema::operator::share_salt,
+                ))
+                .first(&mut conn)
+                .await
+                .map_err(|_| Error::OperatorNotFound)?;
+
+        shares.push(decrypt_share(
+            passphrase_bytes,
+            encrypted_share,
+            &share_nonce_bytes,
+            &share_salt,
+            operator_id_raw,
+        )?);
+    }
+
+    for (recovery_id_raw, passphrase_bytes) in recovery_passphrases {
+        let (encrypted_share, share_nonce_bytes, share_salt): (Vec<u8>, Vec<u8>, Vec<u8>) =
+            schema::recovery_operator::table
+                .find(recovery_id_raw)
+                .select((
+                    schema::recovery_operator::share,
+                    schema::recovery_operator::share_nonce,
+                    schema::recovery_operator::share_salt,
+                ))
+                .first(&mut conn)
+                .await
+                .map_err(|_| Error::OperatorNotFound)?;
+
+        shares.push(decrypt_share(
+            passphrase_bytes,
+            encrypted_share,
+            &share_nonce_bytes,
+            &share_salt,
+            recovery_id_raw,
+        )?);
+    }
+
+    // When threshold==1, shares are raw 32-byte seal keys (vsss-rs cannot split 1-of-N).
+    // Any single decrypted share is the key itself.
+    let seal_key_bytes: [u8; 32] = if threshold <= 1 {
+        let raw = shares
+            .into_iter()
+            .next()
+            .ok_or_else(|| Error::Shamir("No shares available".into()))?;
+        raw.try_into()
+            .map_err(|_| Error::Shamir("Invalid share length".into()))?
+    } else {
+        shamir::combine_shares(&shares).map_err(|e| Error::Shamir(e.to_string()))?
+    };
+
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    vault.ask(TryUnseal { seal_key }).await.map_err(|err| {
+        error!(?err, "Vault unseal failed");
+        Error::VaultError
+    })?;
+
+    Ok(())
+}
+
+/// §3.3: Generate a fresh seal key, split across current operators, re-encrypt the vault root key.
+/// Called after `replace_operator` or `trigger_rekey` is approved and all contributors submit.
+async fn finalize_rekey(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    ordinary_passphrases: HashMap<i32, Vec<u8>>,
+    recovery_passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let ordinary_count = ordinary_passphrases.len();
+    let recovery_count = recovery_passphrases.len();
+    let total = ordinary_count + recovery_count;
+    let threshold = shamir_threshold(ordinary_count);
+
+    let mut new_seal_key_bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut new_seal_key_bytes);
+
+    let shares: Vec<Vec<u8>> = if threshold >= 2 {
+        shamir::split_key(threshold, total, &new_seal_key_bytes, OsRng)
+            .map_err(|e| Error::Shamir(e.to_string()))?
+    } else {
+        std::iter::repeat_with(|| new_seal_key_bytes.to_vec())
+            .take(total)
+            .collect()
+    };
+
+    let mut conn = db.get().await?;
+    let mut shares_iter = shares.into_iter();
+
+    for (operator_id_raw, passphrase_bytes) in ordinary_passphrases {
+        let share = shares_iter
+            .next()
+            .expect("split_key returned enough shares");
+        let (encrypted_share, nonce_bytes, share_salt) = encrypt_share(passphrase_bytes, &share)?;
+
+        diesel::replace_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id_raw)),
+                schema::operator::share.eq(&encrypted_share),
+                schema::operator::share_nonce.eq(&nonce_bytes),
+                schema::operator::share_salt.eq(&share_salt),
+                schema::operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    for (recovery_id_raw, passphrase_bytes) in recovery_passphrases {
+        let share = shares_iter
+            .next()
+            .expect("split_key returned enough shares");
+        let (encrypted_share, nonce_bytes, share_salt) = encrypt_share(passphrase_bytes, &share)?;
+
+        diesel::replace_into(schema::recovery_operator::table)
+            .values((
+                schema::recovery_operator::id.eq(recovery_id_raw),
+                schema::recovery_operator::share.eq(&encrypted_share),
+                schema::recovery_operator::share_nonce.eq(&nonce_bytes),
+                schema::recovery_operator::share_salt.eq(&share_salt),
+                schema::recovery_operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::recovery_operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    drop(conn);
+
+    let new_seal_key = KeyCell::from(new_seal_key_bytes);
+    vault
+        .ask(RekeyRootKey { new_seal_key })
+        .await
+        .map_err(|err| {
+            error!(?err, "Vault rekey failed");
+            Error::VaultError
+        })?;
+
+    Ok(())
+}
+
+#[messages]
+impl VaultCoordinator {
+    /// Phase 1 of multi-operator bootstrap: declare the committee size.
+    #[message]
+    #[expect(clippy::unused_async, reason = "kameo requires messages to be async")]
+    pub async fn start_bootstrap(
+        &mut self,
+        operator_id: i32,
+        declared_count: usize,
+        recovery_count: usize,
+    ) -> Result<(), Error> {
+        let _ = operator_id; // fixme!: any authenticated operator may announce the committee size. the first call wins
+        if !matches!(self.state, CoordinatorState::Idle) {
+            return Err(Error::AlreadyBootstrapping);
+        }
+        if declared_count == 2 && recovery_count == 0 {
+            return Err(Error::TwoOperatorsRequireRecovery);
+        }
+        self.state = CoordinatorState::Bootstrapping {
+            declared_count,
+            recovery_count,
+            passphrases: HashMap::new(),
+            recovery_passphrases: HashMap::new(),
+        };
+        Ok(())
+    }
+
+    /// Phase 2 of multi-operator bootstrap: ordinary operator contributes a passphrase.
+    /// Returns Ok(true) when all ordinary + recovery operators contributed and bootstrap finalized.
+    #[message]
+    pub async fn contribute_bootstrap(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Bootstrapping {
+            declared_count,
+            recovery_count,
+            passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotBootstrapping);
+        };
+
+        if passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        passphrases.insert(operator_id, passphrase_bytes);
+
+        if passphrases.len() < *declared_count || recovery_passphrases.len() < *recovery_count {
+            return Ok(false);
+        }
+
+        let CoordinatorState::Bootstrapping {
+            passphrases,
+            recovery_passphrases,
+            ..
+        } = std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_bootstrap(
+            self.db.clone(),
+            self.vault.clone(),
+            passphrases,
+            recovery_passphrases,
+        )
+        .await?;
+        Ok(true)
+    }
+
+    /// Phase 2 of multi-operator bootstrap: recovery operator contributes a passphrase.
+    /// Returns Ok(true) when all contributors are in and bootstrap finalized.
+    #[message]
+    pub async fn contribute_recovery_bootstrap(
+        &mut self,
+        recovery_operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Bootstrapping {
+            declared_count,
+            recovery_count,
+            passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotBootstrapping);
+        };
+
+        if recovery_passphrases.contains_key(&recovery_operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        recovery_passphrases.insert(recovery_operator_id, passphrase_bytes);
+
+        if passphrases.len() < *declared_count || recovery_passphrases.len() < *recovery_count {
+            return Ok(false);
+        }
+
+        let CoordinatorState::Bootstrapping {
+            passphrases,
+            recovery_passphrases,
+            ..
+        } = std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_bootstrap(
+            self.db.clone(),
+            self.vault.clone(),
+            passphrases,
+            recovery_passphrases,
+        )
+        .await?;
+        Ok(true)
+    }
+
+    /// Contribute a passphrase for vault unseal (ordinary operator).
+    /// Returns Ok(true) when threshold reached and vault is unsealed.
+    #[message]
+    pub async fn contribute_unseal(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        self.ensure_unsealing_state().await?;
+
+        let CoordinatorState::Unsealing {
+            threshold,
+            ordinary_passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotUnsealing);
+        };
+
+        if ordinary_passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        ordinary_passphrases.insert(operator_id, passphrase_bytes);
+
+        if ordinary_passphrases.len() + recovery_passphrases.len() < *threshold {
+            return Ok(false);
+        }
+
+        self.do_finalize_unseal().await
+    }
+
+    /// Contribute a passphrase for vault unseal (recovery operator, §3.5).
+    /// Recovery operators may contribute during unseal when recovery is active.
+    /// Returns Ok(true) when threshold reached and vault is unsealed.
+    #[message]
+    pub async fn contribute_recovery_unseal(
+        &mut self,
+        recovery_operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        self.ensure_unsealing_state().await?;
+
+        let CoordinatorState::Unsealing {
+            threshold,
+            ordinary_passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotUnsealing);
+        };
+
+        if recovery_passphrases.contains_key(&recovery_operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        recovery_passphrases.insert(recovery_operator_id, passphrase_bytes);
+
+        if ordinary_passphrases.len() + recovery_passphrases.len() < *threshold {
+            return Ok(false);
+        }
+
+        self.do_finalize_unseal().await
+    }
+}
+
+impl VaultCoordinator {
+    /// Initializes `CoordinatorState::Unsealing` on first call if still `Idle`.
+    /// Threshold is based on ordinary operator count only (§3.4).
+    async fn ensure_unsealing_state(&mut self) -> Result<(), Error> {
+        if matches!(self.state, CoordinatorState::Idle) {
+            let mut conn = self.db.get().await?;
+            let ordinary_count: i64 = schema::operator::table
+                .count()
+                .get_result(&mut conn)
+                .await?;
+            let threshold = shamir_threshold(usize::try_from(ordinary_count).unwrap_or_default());
+            self.state = CoordinatorState::Unsealing {
+                threshold,
+                ordinary_passphrases: HashMap::new(),
+                recovery_passphrases: HashMap::new(),
+            };
+        }
+        Ok(())
+    }
+
+    /// Moves state back to Idle and calls finalize_unseal.
+    async fn do_finalize_unseal(&mut self) -> Result<bool, Error> {
+        let CoordinatorState::Unsealing {
+            ordinary_passphrases,
+            recovery_passphrases,
+            ..
+        } = std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_unseal(
+            self.db.clone(),
+            self.vault.clone(),
+            ordinary_passphrases,
+            recovery_passphrases,
+        )
+        .await?;
+        Ok(true)
+    }
+
+    async fn do_finalize_rekey(&mut self) -> Result<bool, Error> {
+        let CoordinatorState::Rekeying {
+            passphrases,
+            recovery_passphrases,
+            ..
+        } = std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_rekey(
+            self.db.clone(),
+            self.vault.clone(),
+            passphrases,
+            recovery_passphrases,
+        )
+        .await?;
+        Ok(true)
+    }
+}
+
+#[messages]
+impl VaultCoordinator {
+    /// Begin Shamir re-key after a key-rotation proposal is approved (§3.3).
+    /// Queries the current operator and recovery operator counts from the DB,
+    /// then transitions to Rekeying state awaiting contributions from all of them.
+    #[message]
+    pub async fn start_rekey(&mut self) -> Result<(), Error> {
+        if !matches!(self.state, CoordinatorState::Idle) {
+            return Err(Error::AlreadyBootstrapping);
+        }
+        let mut conn = self.db.get().await?;
+        let ordinary_count: i64 = schema::operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_count: i64 = schema::recovery_operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        self.state = CoordinatorState::Rekeying {
+            ordinary_count: ordinary_count as usize,
+            recovery_count: recovery_count as usize,
+            passphrases: HashMap::new(),
+            recovery_passphrases: HashMap::new(),
+        };
+        Ok(())
+    }
+
+    /// Contribute an ordinary operator passphrase for the re-key.
+    /// Returns Ok(true) when all contributors have submitted and the re-key is complete.
+    #[message]
+    pub async fn contribute_rekey(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Rekeying {
+            ordinary_count,
+            recovery_count,
+            passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotRekeying);
+        };
+
+        if passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        passphrases.insert(operator_id, passphrase.read().to_vec());
+
+        if passphrases.len() < *ordinary_count || recovery_passphrases.len() < *recovery_count {
+            return Ok(false);
+        }
+
+        self.do_finalize_rekey().await
+    }
+
+    /// Contribute a recovery operator passphrase for the re-key.
+    /// Returns Ok(true) when all contributors have submitted and the re-key is complete.
+    #[message]
+    pub async fn contribute_recovery_rekey(
+        &mut self,
+        recovery_operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Rekeying {
+            ordinary_count,
+            recovery_count,
+            passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotRekeying);
+        };
+
+        if recovery_passphrases.contains_key(&recovery_operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        recovery_passphrases.insert(recovery_operator_id, passphrase.read().to_vec());
+
+        if passphrases.len() < *ordinary_count || recovery_passphrases.len() < *recovery_count {
+            return Ok(false);
+        }
+
+        self.do_finalize_rekey().await
+    }
+}
--- a/server/crates/arbiter-server/src/crypto/encryption/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/encryption/v1.rs
@@ -61,12 +61,12 @@ mod tests {
    #[test]
    fn derive_seal_key_deterministic() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
-        let password2 = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
+        let mut password2 = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key1 = derive_key(password, &salt);
-        let mut key2 = derive_key(password2, &salt);
+        let mut key1 = derive_key(&mut password, &salt);
+        let mut key2 = derive_key(&mut password2, &salt);

        let key1_reader = key1.0.read();
        let key2_reader = key2.0.read();
@@ -77,10 +77,10 @@ mod tests {
    #[test]
    fn successful_derive() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key = derive_key(password, &salt);
+        let mut key = derive_key(&mut password, &salt);
        let key_reader = key.0.read();

        assert_ne!(key_reader.as_slice(), &[0u8; 32][..]);
--- a/server/crates/arbiter-server/src/crypto/governance.rs
+++ b/server/crates/arbiter-server/src/crypto/governance.rs
@@ -0,0 +1,99 @@
+//! Canonical encoding and verification of governance vote signatures (§3.3).
+
+use crate::db::models::ProposalId;
+use arbiter_crypto::authn::{self, SigningContext};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
+pub enum VerifyError {
+    #[error("Malformed operator public key")]
+    PublicKey,
+    #[error("Malformed vote signature")]
+    Signature,
+    #[error("Signature does not match this vote")]
+    Mismatch,
+}
+
+/// Canonical bytes an operator signs when voting: `proposal_id` as i64 big-endian,
+/// followed by the approve flag as one byte.
+///
+/// The flag is part of the message on purpose: without it an approval could be
+/// replayed as a rejection of the same proposal.
+#[must_use]
+pub fn vote_message(proposal_id: ProposalId, approve: bool) -> Vec<u8> {
+    let mut message = Vec::with_capacity(9);
+    message.extend_from_slice(&i64::from(proposal_id.to_raw()).to_be_bytes());
+    message.push(u8::from(approve));
+    message
+}
+
+/// Verifies a vote signature against an operator's stored public key.
+pub fn verify_vote(
+    public_key: &[u8],
+    proposal_id: ProposalId,
+    approve: bool,
+    signature: &[u8],
+) -> Result<(), VerifyError> {
+    let public_key = authn::PublicKey::try_from(public_key).map_err(|()| VerifyError::PublicKey)?;
+    let signature = authn::Signature::try_from(signature).map_err(|()| VerifyError::Signature)?;
+
+    if public_key.verify_message(
+        &vote_message(proposal_id, approve),
+        SigningContext::GovernanceVote,
+        &signature,
+    ) {
+        Ok(())
+    } else {
+        Err(VerifyError::Mismatch)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{VerifyError, verify_vote, vote_message};
+    use crate::db::models::ProposalId;
+    use arbiter_crypto::authn::{SigningContext, SigningKey};
+
+    #[test]
+    fn vote_message_is_the_id_then_the_approve_flag() {
+        let message = vote_message(ProposalId::from_raw(0x0102), true);
+        assert_eq!(message, vec![0, 0, 0, 0, 0, 0, 1, 2, 1]);
+    }
+
+    #[test]
+    fn verify_vote_accepts_a_matching_signature() {
+        let key = SigningKey::generate();
+        let id = ProposalId::from_raw(42);
+        let signature = key
+            .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+            .unwrap();
+
+        verify_vote(
+            &key.public_key().to_bytes(),
+            id,
+            true,
+            &signature.to_bytes(),
+        )
+        .expect("a signature over this exact vote must verify");
+    }
+
+    /// The decisive one: an approval must not verify as a rejection of the same
+    /// proposal, or a captured vote could be replayed with its meaning flipped.
+    #[test]
+    fn verify_vote_rejects_a_flipped_approve_flag() {
+        let key = SigningKey::generate();
+        let id = ProposalId::from_raw(42);
+        let signature = key
+            .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+            .unwrap();
+
+        assert!(matches!(
+            verify_vote(
+                &key.public_key().to_bytes(),
+                id,
+                false,
+                &signature.to_bytes()
+            ),
+            Err(VerifyError::Mismatch)
+        ));
+    }
+}
--- a/server/crates/arbiter-server/src/crypto/integrity/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/integrity/v1.rs
@@ -215,8 +215,6 @@ mod tests {
        },
        db::{self, schema},
    };
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-
    use super::{Error, Integrable, sign_entity, verify_entity};
    #[derive(Clone, arbiter_macros::Hashable)]
    struct DummyEntity {
@@ -235,7 +233,7 @@ mod tests {
        );
        actor
            .ask(Bootstrap {
-                seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
+                seal_key: crate::crypto::KeyCell::from([0u8; 32]),
            })
            .await
            .unwrap();
--- a/server/crates/arbiter-server/src/crypto/mod.rs
+++ b/server/crates/arbiter-server/src/crypto/mod.rs
@@ -1,5 +1,5 @@
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-use encryption::v1::{Nonce, Salt};
+use encryption::v1::Nonce;

 use argon2::{Algorithm, Argon2};
 use chacha20poly1305::{
@@ -12,7 +12,9 @@ use rand::{
 };

 pub mod encryption;
+pub mod governance;
 pub mod integrity;
+pub mod shamir;

 pub struct KeyCell(pub SafeCell<Key>);
 impl From<SafeCell<Key>> for KeyCell {
@@ -20,6 +22,15 @@ impl From<SafeCell<Key>> for KeyCell {
        Self(value)
    }
 }
+impl From<[u8; 32]> for KeyCell {
+    fn from(bytes: [u8; 32]) -> Self {
+        let cell = SafeCell::new_inline_default(|key: &mut Key| {
+            key.copy_from_slice(&bytes);
+        });
+        Self(cell)
+    }
+}
+
 impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
    type Error = ();

@@ -28,7 +39,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
        if value.len() != size_of::<Key>() {
            return Err(());
        }
-        let cell = SafeCell::new_inline(|cell_write: &mut Key| {
+        let cell = SafeCell::new_inline_default(|cell_write: &mut Key| {
            cell_write.copy_from_slice(&value);
        });
        Ok(Self(cell))
@@ -37,7 +48,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {

 impl KeyCell {
    pub fn new_secure_random() -> Self {
-        let key = SafeCell::new_inline(|key_buffer: &mut Key| {
+        let key = SafeCell::new_inline_default(|key_buffer: &mut Key| {
            let mut rng = StdRng::try_from_rng(&mut SysRng)
                .expect("Rng failure is unrecoverable and should panic");
            rng.fill_bytes(key_buffer);
@@ -94,7 +105,7 @@ impl KeyCell {
 }

 /// Derive a fixed-length key from the password using Argon2id, which is designed for password hashing and key derivation.
-pub fn derive_key(mut password: SafeCell<Vec<u8>>, salt: &Salt) -> KeyCell {
+pub fn derive_key(password: &mut SafeCell<Vec<u8>>, salt: &[u8]) -> KeyCell {
    let params = {
        #[cfg(debug_assertions)]
        {
@@ -132,10 +143,10 @@ mod tests {
    #[test]
    fn encrypt_decrypt() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key = derive_key(password, &salt);
+        let mut key = derive_key(&mut password, &salt);
        let nonce = Nonce(*b"unique nonce 123 1231233"); // 24 bytes for XChaCha20Poly1305
        let associated_data = b"associated data";
        let mut buffer = b"secret data".to_vec();
--- a/server/crates/arbiter-server/src/crypto/shamir.rs
+++ b/server/crates/arbiter-server/src/crypto/shamir.rs
@@ -0,0 +1,41 @@
+use vsss_rs::Gf256;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ShamirError {
+    #[error("Failed to split key: {0}")]
+    Split(String),
+    #[error("Failed to combine shares: {0}")]
+    Combine(String),
+}
+
+/// Split `key` into `total` shares where any `threshold` shares can reconstruct it.
+/// Each returned Vec<u8> is a share with format [`identifier_byte`, `value_bytes`...].
+pub fn split_key(
+    threshold: usize,
+    total: usize,
+    key: &[u8; 32],
+    rng: impl rand_core::RngCore + rand_core::CryptoRng,
+) -> Result<Vec<Vec<u8>>, ShamirError> {
+    Gf256::split_array(threshold, total, key.as_slice(), rng)
+        .map_err(|e| ShamirError::Split(format!("{e:?}")))
+}
+
+/// Returns the minimum number of shares required to reconstruct the secret
+/// for a committee of `n` operators.
+#[must_use]
+pub const fn shamir_threshold(n: usize) -> usize {
+    match n {
+        0 => panic!("No operators"),
+        1 => 1,
+        2 => 2,
+        n => n / 2 + 1,
+    }
+}
+
+/// Reconstruct the secret from `threshold` or more shares.
+pub fn combine_shares(shares: &[Vec<u8>]) -> Result<[u8; 32], ShamirError> {
+    let bytes = Gf256::combine_array(shares)
+        .map_err(|e| ShamirError::Combine(format!("{e:?}")))?;
+    <[u8; 32]>::try_from(bytes.as_slice())
+        .map_err(|_| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
+}
--- a/server/crates/arbiter-server/src/db/functions.rs
+++ b/server/crates/arbiter-server/src/db/functions.rs
@@ -0,0 +1,12 @@
+//! Typed bindings for the SQLite scalar functions used in Diesel expressions.
+
+use diesel::sql_types::{Integer, Text};
+
+diesel::define_sql_function! {
+    /// SQLite `unixepoch(modifier)` -- seconds since the Unix epoch.
+    ///
+    /// Declared so timestamp comparisons are built by the query DSL instead of by
+    /// `format!`-ing a SQL fragment: the argument becomes a bind parameter and the
+    /// result type is checked against the column it is compared with.
+    fn unixepoch(modifier: Text) -> Integer;
+}
--- a/server/crates/arbiter-server/src/db/mod.rs
+++ b/server/crates/arbiter-server/src/db/mod.rs
@@ -8,7 +8,9 @@ use diesel_migrations::{EmbeddedMigrations, MigrationHarness, embed_migrations};
 use thiserror::Error;
 use tracing::info;

+pub mod functions;
 pub mod models;
+pub mod proposal;
 pub mod schema;

 pub type DatabaseConnection = SyncConnectionWrapper<SqliteConnection>;
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -9,16 +9,18 @@ use crate::db::schema::{
    integrity_envelope, root_key_history, tls_history,
 };

+use crate::db::proposal::ProposalKindTag;
 use diesel::{prelude::*, sqlite::Sqlite};
 use restructed::Models;

 pub mod types {
    use chrono::{DateTime, Utc};
    use diesel::{
+        backend::Backend,
        deserialize::{FromSql, FromSqlRow},
        expression::AsExpression,
        serialize::{IsNull, ToSql},
-        sql_types::Integer,
+        sql_types::{Integer, Text},
        sqlite::{Sqlite, SqliteType},
    };

@@ -61,7 +63,7 @@ pub mod types {

    impl FromSql<Integer, Sqlite> for SqliteTimestamp {
        fn from_sql(
-            mut bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+            mut bytes: <Sqlite as Backend>::RawValue<'_>,
        ) -> diesel::deserialize::Result<Self> {
            let Some(SqliteType::Long) = bytes.value_type() else {
                return Err(format!(
@@ -141,6 +143,42 @@ pub mod types {
    declare_id!(TlsHistoryId);
    declare_id!(EvmWalletId);
    declare_id!(ClientId);
+    declare_id!(ProposalId);
+    declare_id!(RecoveryOperatorIdentityId);
+
+    #[derive(Debug, Clone, PartialEq, Eq, AsExpression, FromSqlRow)]
+    #[diesel(sql_type = Text)]
+    pub enum ProposalStatus {
+        Pending,
+        Approved,
+        Rejected,
+    }
+
+    impl ToSql<Text, Sqlite> for ProposalStatus {
+        fn to_sql<'b>(
+            &'b self,
+            out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+        ) -> diesel::serialize::Result {
+            let s: &str = match self {
+                Self::Pending => "pending",
+                Self::Approved => "approved",
+                Self::Rejected => "rejected",
+            };
+            <str as ToSql<Text, Sqlite>>::to_sql(s, out)
+        }
+    }
+
+    impl FromSql<Text, Sqlite> for ProposalStatus {
+        fn from_sql(bytes: <Sqlite as Backend>::RawValue<'_>) -> diesel::deserialize::Result<Self> {
+            let s = <String as FromSql<Text, Sqlite>>::from_sql(bytes)?;
+            match s.as_str() {
+                "pending" => Ok(Self::Pending),
+                "approved" => Ok(Self::Approved),
+                "rejected" => Ok(Self::Rejected),
+                other => Err(format!("Unknown proposal status: {other}").into()),
+            }
+        }
+    }
 }
 pub use types::*;

@@ -285,6 +323,7 @@ pub struct Operator {
    pub id: OperatorId,
    pub share: Vec<u8>,
    pub share_nonce: Vec<u8>,
+    pub share_salt: Vec<u8>,
    pub created_at: SqliteTimestamp,
    pub updated_at: SqliteTimestamp,
 }
@@ -437,3 +476,58 @@ pub struct IntegrityEnvelope {
    pub signed_at: SqliteTimestamp,
    pub created_at: SqliteTimestamp,
 }
+
+#[derive(Debug, Queryable, Selectable, Identifiable)]
+#[diesel(table_name = schema::proposal, check_for_backend(Sqlite))]
+pub struct Proposal {
+    pub id: ProposalId,
+    pub kind: ProposalKindTag,
+    pub initiator_id: OperatorIdentityId,
+    pub created_at: SqliteTimestamp,
+    pub expires_at: SqliteTimestamp,
+    pub status: ProposalStatus,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal, check_for_backend(Sqlite))]
+pub struct NewProposal {
+    pub kind: ProposalKindTag,
+    pub initiator_id: OperatorIdentityId,
+    // status defaults to 'pending' at the DB layer
+    pub expires_at: SqliteTimestamp,
+}
+
+#[derive(Debug, Queryable, Selectable, Identifiable)]
+#[diesel(table_name = schema::proposal_vote, check_for_backend(Sqlite))]
+pub struct ProposalVote {
+    pub id: i32,
+    pub proposal_id: ProposalId,
+    pub operator_id: OperatorIdentityId,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+    pub voted_at: SqliteTimestamp,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal_vote, check_for_backend(Sqlite))]
+pub struct NewProposalVote {
+    pub proposal_id: ProposalId,
+    pub operator_id: OperatorIdentityId,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::recovery_proposal_vote, check_for_backend(Sqlite))]
+pub struct NewRecoveryProposalVote {
+    pub proposal_id: ProposalId,
+    pub recovery_operator_id: RecoveryOperatorIdentityId,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::recovery_wakeup_request, check_for_backend(Sqlite))]
+pub struct NewRecoveryWakeupRequest {
+    pub requested_by: OperatorIdentityId,
+}
--- a/server/crates/arbiter-server/src/db/proposal/approve_sdk_client.rs
+++ b/server/crates/arbiter-server/src/db/proposal/approve_sdk_client.rs
@@ -0,0 +1,48 @@
+//! Approving an SDK client so it may authenticate against the vault.
+
+use super::{Proposal, ProposalKindTag};
+use crate::db::{
+    DatabaseConnection, models::ProposalId, schema::proposal_approve_sdk_client as table,
+};
+use diesel::{
+    ExpressionMethods as _, Insertable, QueryDsl as _, QueryResult, Queryable, Selectable,
+    SelectableHelper as _, sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Queryable, Selectable, Insertable)]
+#[diesel(table_name = table, check_for_backend(Sqlite))]
+pub struct Settings {
+    pub client_id: i32,
+}
+
+pub struct ApproveSdkClient;
+
+impl Proposal for ApproveSdkClient {
+    const KIND: ProposalKindTag = ProposalKindTag::ApproveSdkClient;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(table::table)
+            .values((table::proposal_id.eq(proposal_id), settings))
+            .execute(conn)
+            .await
+            .map(drop)
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        table::table
+            .find(proposal_id)
+            .select(Settings::as_select())
+            .first(conn)
+            .await
+    }
+}
--- a/server/crates/arbiter-server/src/db/proposal/grant_wallet_access.rs
+++ b/server/crates/arbiter-server/src/db/proposal/grant_wallet_access.rs
@@ -0,0 +1,49 @@
+//! Granting an SDK client visibility of a wallet.
+
+use super::{Proposal, ProposalKindTag};
+use crate::db::{
+    DatabaseConnection, models::ProposalId, schema::proposal_grant_wallet_access as table,
+};
+use diesel::{
+    ExpressionMethods as _, Insertable, QueryDsl as _, QueryResult, Queryable, Selectable,
+    SelectableHelper as _, sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Queryable, Selectable, Insertable)]
+#[diesel(table_name = table, check_for_backend(Sqlite))]
+pub struct Settings {
+    pub wallet_id: i32,
+    pub client_id: i32,
+}
+
+pub struct GrantWalletAccess;
+
+impl Proposal for GrantWalletAccess {
+    const KIND: ProposalKindTag = ProposalKindTag::GrantWalletAccess;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(table::table)
+            .values((table::proposal_id.eq(proposal_id), settings))
+            .execute(conn)
+            .await
+            .map(drop)
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        table::table
+            .find(proposal_id)
+            .select(Settings::as_select())
+            .first(conn)
+            .await
+    }
+}
--- a/server/crates/arbiter-server/src/db/proposal/mod.rs
+++ b/server/crates/arbiter-server/src/db/proposal/mod.rs
@@ -0,0 +1,243 @@
+//! Governed actions and the parameters they carry.
+//!
+//! Laid out the way [`crate::evm::policies::Policy`] is: a unit type per kind, its
+//! parameters as an associated `Settings`, and the persistence for those parameters
+//! implemented next to them. Everything downstream is generic over [`Proposal`], so a
+//! new kind is a new module plus one arm in each dispatcher -- nothing else in the
+//! codebase has to learn about it.
+
+use crate::db::{DatabaseConnection, models::ProposalId};
+use diesel::{
+    QueryResult,
+    backend::Backend,
+    deserialize::{FromSql, FromSqlRow},
+    expression::AsExpression,
+    serialize::ToSql,
+    sql_types::Text,
+    sqlite::Sqlite,
+};
+use strum::{Display, EnumDiscriminants, EnumString, IntoStaticStr};
+
+pub mod approve_sdk_client;
+pub mod grant_wallet_access;
+pub mod one_off_transaction;
+pub mod persistent_grant;
+pub mod replace_operator;
+pub mod trigger_rekey;
+
+pub use approve_sdk_client::ApproveSdkClient;
+pub use grant_wallet_access::GrantWalletAccess;
+pub use one_off_transaction::OneOffTransaction;
+pub use persistent_grant::PersistentGrant;
+pub use replace_operator::ReplaceOperator;
+pub use trigger_rekey::TriggerRekey;
+
+/// A governed action that owns the child table holding its parameters.
+pub trait Proposal: Sized {
+    /// The value stored in `proposal.kind` for this action.
+    const KIND: ProposalKindTag;
+
+    /// Parameters the action is voted on with.
+    type Settings: Send + Sync + 'static;
+
+    /// Writes the child row carrying `settings`.
+    fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> impl Future<Output = QueryResult<()>> + Send;
+
+    /// Reads the child row back. A missing row surfaces as [`diesel::result::Error::NotFound`],
+    /// which is what a proposal without its parameters is.
+    fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> impl Future<Output = QueryResult<Self::Settings>> + Send;
+}
+
+/// Parameters of a proposal, in the one shape that can cross the actor boundary.
+///
+/// Every variant holds the `Settings` of the matching [`Proposal`] implementation, so
+/// the two cannot drift.
+#[derive(Debug, Clone, EnumDiscriminants)]
+#[strum_discriminants(
+    name(ProposalKindTag),
+    vis(pub),
+    derive(Display, EnumString, IntoStaticStr, AsExpression, FromSqlRow),
+    diesel(sql_type = Text),
+    strum(serialize_all = "snake_case")
+)]
+pub enum ProposalKind {
+    ApproveSdkClient(approve_sdk_client::Settings),
+    GrantWalletAccess(grant_wallet_access::Settings),
+    ReplaceOperator(replace_operator::Settings),
+    TriggerRekey,
+    ApprovePersistentGrant(Box<persistent_grant::Settings>),
+    ApproveOneOffTransaction(Box<one_off_transaction::Settings>),
+}
+
+impl ProposalKindTag {
+    /// Key-rotation proposals require every operator to approve (§3.3).
+    #[must_use]
+    pub const fn requires_full_quorum(self) -> bool {
+        matches!(self, Self::ReplaceOperator | Self::TriggerRekey)
+    }
+}
+
+/// Pins every implementation to the variant it is dispatched from. Without this a
+/// mistyped `KIND` would compile and only show up as a proposal stored under the
+/// wrong `proposal.kind`.
+const _: () = {
+    assert!(
+        matches!(ApproveSdkClient::KIND, ProposalKindTag::ApproveSdkClient),
+        "ApproveSdkClient::KIND must be ProposalKindTag::ApproveSdkClient"
+    );
+    assert!(
+        matches!(GrantWalletAccess::KIND, ProposalKindTag::GrantWalletAccess),
+        "GrantWalletAccess::KIND must be ProposalKindTag::GrantWalletAccess"
+    );
+    assert!(
+        matches!(ReplaceOperator::KIND, ProposalKindTag::ReplaceOperator),
+        "ReplaceOperator::KIND must be ProposalKindTag::ReplaceOperator"
+    );
+    assert!(
+        matches!(TriggerRekey::KIND, ProposalKindTag::TriggerRekey),
+        "TriggerRekey::KIND must be ProposalKindTag::TriggerRekey"
+    );
+    assert!(
+        matches!(
+            PersistentGrant::KIND,
+            ProposalKindTag::ApprovePersistentGrant
+        ),
+        "PersistentGrant::KIND must be ProposalKindTag::ApprovePersistentGrant"
+    );
+    assert!(
+        matches!(
+            OneOffTransaction::KIND,
+            ProposalKindTag::ApproveOneOffTransaction
+        ),
+        "OneOffTransaction::KIND must be ProposalKindTag::ApproveOneOffTransaction"
+    );
+};
+
+/// Writes the child row carrying this proposal's parameters.
+///
+/// The only place the create path has to know every kind; each arm hands straight off
+/// to the implementation that owns the table.
+pub async fn insert_kind(
+    conn: &mut DatabaseConnection,
+    proposal_id: ProposalId,
+    kind: &ProposalKind,
+) -> QueryResult<()> {
+    match kind {
+        ProposalKind::ApproveSdkClient(s) => ApproveSdkClient::insert(proposal_id, s, conn).await,
+        ProposalKind::GrantWalletAccess(s) => GrantWalletAccess::insert(proposal_id, s, conn).await,
+        ProposalKind::ReplaceOperator(s) => ReplaceOperator::insert(proposal_id, s, conn).await,
+        ProposalKind::TriggerRekey => TriggerRekey::insert(proposal_id, &(), conn).await,
+        ProposalKind::ApprovePersistentGrant(s) => {
+            PersistentGrant::insert(proposal_id, s, conn).await
+        }
+        ProposalKind::ApproveOneOffTransaction(s) => {
+            OneOffTransaction::insert(proposal_id, s, conn).await
+        }
+    }
+}
+
+/// Reads the parameters back for a `proposal.kind` that is only known at runtime.
+pub async fn load_kind(
+    conn: &mut DatabaseConnection,
+    proposal_id: ProposalId,
+    tag: ProposalKindTag,
+) -> QueryResult<ProposalKind> {
+    Ok(match tag {
+        ProposalKindTag::ApproveSdkClient => {
+            ProposalKind::ApproveSdkClient(ApproveSdkClient::load(proposal_id, conn).await?)
+        }
+        ProposalKindTag::GrantWalletAccess => {
+            ProposalKind::GrantWalletAccess(GrantWalletAccess::load(proposal_id, conn).await?)
+        }
+        ProposalKindTag::ReplaceOperator => {
+            ProposalKind::ReplaceOperator(ReplaceOperator::load(proposal_id, conn).await?)
+        }
+        ProposalKindTag::TriggerRekey => {
+            TriggerRekey::load(proposal_id, conn).await?;
+            ProposalKind::TriggerRekey
+        }
+        ProposalKindTag::ApprovePersistentGrant => ProposalKind::ApprovePersistentGrant(Box::new(
+            PersistentGrant::load(proposal_id, conn).await?,
+        )),
+        ProposalKindTag::ApproveOneOffTransaction => ProposalKind::ApproveOneOffTransaction(
+            Box::new(OneOffTransaction::load(proposal_id, conn).await?),
+        ),
+    })
+}
+
+impl ToSql<Text, Sqlite> for ProposalKindTag {
+    fn to_sql<'b>(
+        &'b self,
+        out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+    ) -> diesel::serialize::Result {
+        <str as ToSql<Text, Sqlite>>::to_sql(<&'static str>::from(*self), out)
+    }
+}
+
+impl FromSql<Text, Sqlite> for ProposalKindTag {
+    fn from_sql(bytes: <Sqlite as Backend>::RawValue<'_>) -> diesel::deserialize::Result<Self> {
+        let s = <String as FromSql<Text, Sqlite>>::from_sql(bytes)?;
+        s.parse()
+            .map_err(|_| format!("Unknown proposal kind: {s}").into())
+    }
+}
+
+/// SQLite has no unsigned integers; the column is `BigInt`, so a value that does not
+/// round-trip is a corrupt row rather than something to silently wrap.
+pub(crate) fn as_i64(value: u64) -> QueryResult<i64> {
+    i64::try_from(value).map_err(|_| diesel::result::Error::SerializationError(Box::new(Overflow)))
+}
+
+pub(crate) fn as_u64(value: i64) -> QueryResult<u64> {
+    u64::try_from(value)
+        .map_err(|_| diesel::result::Error::DeserializationError(Box::new(Overflow)))
+}
+
+pub(crate) fn fixed_bytes<const N: usize>(
+    bytes: &[u8],
+    column: &'static str,
+) -> QueryResult<[u8; N]> {
+    <[u8; N]>::try_from(bytes)
+        .map_err(|_| diesel::result::Error::DeserializationError(Box::new(WrongLength(column))))
+}
+
+/// Reads a fixed-width column into an array, labelling failures with the column it came
+/// from.
+///
+/// The label is taken from the field itself, so renaming a column cannot leave a stale
+/// name behind in the error -- which is the whole reason this is a macro and not a
+/// second argument.
+///
+/// - `fixed!(row.column)` for a `Vec<u8>` field
+/// - `fixed!(opt row.column)` for a `Option<Vec<u8>>` one
+/// - `fixed!(binding)` for a local
+macro_rules! fixed {
+    (opt $src:ident.$field:ident) => {
+        $src.$field
+            .as_deref()
+            .map(|value| $crate::db::proposal::fixed_bytes(value, stringify!($field)))
+            .transpose()
+    };
+    ($src:ident.$field:ident) => {
+        $crate::db::proposal::fixed_bytes(&$src.$field, stringify!($field))
+    };
+    ($binding:ident) => {
+        $crate::db::proposal::fixed_bytes(&$binding, stringify!($binding))
+    };
+}
+pub(crate) use fixed;
+
+#[derive(Debug, thiserror::Error)]
+#[error("value does not fit a SQLite integer")]
+struct Overflow;
+
+#[derive(Debug, thiserror::Error)]
+#[error("column {0} has the wrong byte length")]
+struct WrongLength(&'static str);
--- a/server/crates/arbiter-server/src/db/proposal/one_off_transaction.rs
+++ b/server/crates/arbiter-server/src/db/proposal/one_off_transaction.rs
@@ -0,0 +1,138 @@
+//! Signing a single EIP-1559 transaction.
+
+use super::{Proposal, ProposalKindTag, as_i64, as_u64, fixed};
+use crate::db::{
+    DatabaseConnection,
+    models::ProposalId,
+    schema::{proposal_one_off_transaction, proposal_one_off_transaction_result},
+};
+use diesel::{
+    Insertable, QueryDsl as _, QueryResult, Queryable, Selectable, SelectableHelper as _,
+    sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Settings {
+    pub client_id: i32,
+    pub wallet_address: [u8; 20],
+    pub chain_id: u64,
+    pub nonce: u64,
+    pub gas_limit: u64,
+    pub max_fee_per_gas: u128,
+    pub max_priority_fee_per_gas: u128,
+    pub to: [u8; 20],
+    pub value: [u8; 32],
+    pub input: Vec<u8>,
+}
+
+#[derive(Debug, Queryable, Selectable, Insertable)]
+#[diesel(table_name = proposal_one_off_transaction, check_for_backend(Sqlite))]
+struct Row {
+    proposal_id: ProposalId,
+    client_id: i32,
+    wallet_address: Vec<u8>,
+    chain_id: i64,
+    nonce: i64,
+    gas_limit: i64,
+    max_fee_per_gas: Vec<u8>,
+    max_priority_fee_per_gas: Vec<u8>,
+    to_address: Vec<u8>,
+    value: Vec<u8>,
+    input: Vec<u8>,
+}
+
+impl Row {
+    fn new(proposal_id: ProposalId, settings: &Settings) -> QueryResult<Self> {
+        Ok(Self {
+            proposal_id,
+            client_id: settings.client_id,
+            wallet_address: settings.wallet_address.to_vec(),
+            chain_id: as_i64(settings.chain_id)?,
+            nonce: as_i64(settings.nonce)?,
+            gas_limit: as_i64(settings.gas_limit)?,
+            max_fee_per_gas: settings.max_fee_per_gas.to_be_bytes().to_vec(),
+            max_priority_fee_per_gas: settings.max_priority_fee_per_gas.to_be_bytes().to_vec(),
+            to_address: settings.to.to_vec(),
+            value: settings.value.to_vec(),
+            input: settings.input.clone(),
+        })
+    }
+
+    fn into_settings(self) -> QueryResult<Settings> {
+        Ok(Settings {
+            client_id: self.client_id,
+            wallet_address: fixed!(self.wallet_address)?,
+            chain_id: as_u64(self.chain_id)?,
+            nonce: as_u64(self.nonce)?,
+            gas_limit: as_u64(self.gas_limit)?,
+            max_fee_per_gas: u128::from_be_bytes(fixed!(self.max_fee_per_gas)?),
+            max_priority_fee_per_gas: u128::from_be_bytes(fixed!(self.max_priority_fee_per_gas)?),
+            to: fixed!(self.to_address)?,
+            value: fixed!(self.value)?,
+            input: self.input,
+        })
+    }
+}
+
+pub struct OneOffTransaction;
+
+impl Proposal for OneOffTransaction {
+    const KIND: ProposalKindTag = ProposalKindTag::ApproveOneOffTransaction;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(proposal_one_off_transaction::table)
+            .values(&Row::new(proposal_id, settings)?)
+            .execute(conn)
+            .await
+            .map(drop)
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        let row: Row = proposal_one_off_transaction::table
+            .find(proposal_id)
+            .select(Row::as_select())
+            .first(conn)
+            .await?;
+
+        row.into_settings()
+    }
+}
+
+/// The signature the vault produced for an approved transaction.
+#[derive(Debug, Insertable)]
+#[diesel(table_name = proposal_one_off_transaction_result, check_for_backend(Sqlite))]
+struct SignatureRow {
+    proposal_id: ProposalId,
+    r: Vec<u8>,
+    s: Vec<u8>,
+    y_parity: i32,
+}
+
+/// Records the signature produced for an approved transaction, by component, so what
+/// came back is as readable as what was signed.
+pub async fn store_signature(
+    proposal_id: ProposalId,
+    signature: &alloy::signers::Signature,
+    conn: &mut DatabaseConnection,
+) -> QueryResult<()> {
+    diesel::insert_into(proposal_one_off_transaction_result::table)
+        .values(&SignatureRow {
+            proposal_id,
+            r: signature.r().to_be_bytes::<32>().to_vec(),
+            s: signature.s().to_be_bytes::<32>().to_vec(),
+            y_parity: i32::from(signature.v()),
+        })
+        .execute(conn)
+        .await
+        .map(drop)
+}
--- a/server/crates/arbiter-server/src/db/proposal/persistent_grant.rs
+++ b/server/crates/arbiter-server/src/db/proposal/persistent_grant.rs
@@ -0,0 +1,271 @@
+//! Creating a standing EVM grant.
+use super::{Proposal, ProposalKindTag, as_i64, as_u64, fixed};
+use crate::db::{
+    DatabaseConnection,
+    models::ProposalId,
+    schema::{
+        proposal_persistent_grant, proposal_persistent_grant_ether,
+        proposal_persistent_grant_ether_target, proposal_persistent_grant_token,
+        proposal_persistent_grant_token_limit,
+    },
+};
+use diesel::{
+    ExpressionMethods as _, Insertable, OptionalExtension as _, QueryDsl as _, QueryResult,
+    Queryable, Selectable, SelectableHelper as _, sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Settings {
+    pub wallet_access_id: i32,
+    pub chain_id: u64,
+    pub valid_from_secs: Option<i64>,
+    pub valid_until_secs: Option<i64>,
+    pub max_gas_fee_per_gas: Option<[u8; 32]>,
+    pub max_priority_fee_per_gas: Option<[u8; 32]>,
+    pub rate_limit: Option<RateLimit>,
+    pub specific: Specific,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct RateLimit {
+    pub count: u32,
+    pub window_secs: i64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct VolumeLimit {
+    pub max_volume: [u8; 32],
+    pub window_secs: i64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Specific {
+    EtherTransfer {
+        targets: Vec<[u8; 20]>,
+        limit: VolumeLimit,
+    },
+    TokenTransfer {
+        token_contract: [u8; 20],
+        receiver: Option<[u8; 20]>,
+        volume_limits: Vec<VolumeLimit>,
+    },
+}
+
+/// Shared settings, mirroring `evm_basic_grant`.
+#[derive(Debug, Queryable, Selectable, Insertable)]
+#[diesel(table_name = proposal_persistent_grant, check_for_backend(Sqlite))]
+struct BaseRow {
+    proposal_id: ProposalId,
+    wallet_access_id: i32,
+    chain_id: i64,
+    valid_from: Option<i64>,
+    valid_until: Option<i64>,
+    max_gas_fee_per_gas: Option<Vec<u8>>,
+    max_priority_fee_per_gas: Option<Vec<u8>>,
+    rate_limit_count: Option<i32>,
+    rate_limit_window_secs: Option<i64>,
+}
+
+#[derive(Debug, Queryable, Selectable, Insertable)]
+#[diesel(table_name = proposal_persistent_grant_ether, check_for_backend(Sqlite))]
+struct EtherRow {
+    proposal_id: ProposalId,
+    window_secs: i64,
+    max_volume: Vec<u8>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = proposal_persistent_grant_ether_target, check_for_backend(Sqlite))]
+struct NewEtherTarget {
+    proposal_id: ProposalId,
+    address: Vec<u8>,
+}
+
+#[derive(Debug, Queryable, Selectable, Insertable)]
+#[diesel(table_name = proposal_persistent_grant_token, check_for_backend(Sqlite))]
+struct TokenRow {
+    proposal_id: ProposalId,
+    token_contract: Vec<u8>,
+    receiver: Option<Vec<u8>>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = proposal_persistent_grant_token_limit, check_for_backend(Sqlite))]
+struct NewTokenLimit {
+    proposal_id: ProposalId,
+    window_secs: i64,
+    max_volume: Vec<u8>,
+}
+
+impl BaseRow {
+    fn new(proposal_id: ProposalId, settings: &Settings) -> QueryResult<Self> {
+        Ok(Self {
+            proposal_id,
+            wallet_access_id: settings.wallet_access_id,
+            chain_id: as_i64(settings.chain_id)?,
+            valid_from: settings.valid_from_secs,
+            valid_until: settings.valid_until_secs,
+            max_gas_fee_per_gas: settings.max_gas_fee_per_gas.map(|v| v.to_vec()),
+            max_priority_fee_per_gas: settings.max_priority_fee_per_gas.map(|v| v.to_vec()),
+            // SQLite stores integers signed; a rate-limit count is a `u32`, so it
+            // round-trips through the bit pattern rather than a fallible range check.
+            rate_limit_count: settings.rate_limit.map(|r| r.count.cast_signed()),
+            rate_limit_window_secs: settings.rate_limit.map(|r| r.window_secs),
+        })
+    }
+
+    fn into_settings(self, specific: Specific) -> QueryResult<Settings> {
+        Ok(Settings {
+            wallet_access_id: self.wallet_access_id,
+            chain_id: as_u64(self.chain_id)?,
+            valid_from_secs: self.valid_from,
+            valid_until_secs: self.valid_until,
+            max_gas_fee_per_gas: fixed!(opt self.max_gas_fee_per_gas)?,
+            max_priority_fee_per_gas: fixed!(opt self.max_priority_fee_per_gas)?,
+            rate_limit: self.rate_limit_count.zip(self.rate_limit_window_secs).map(
+                |(count, window_secs)| RateLimit {
+                    count: count.cast_unsigned(),
+                    window_secs,
+                },
+            ),
+            specific,
+        })
+    }
+}
+
+pub struct PersistentGrant;
+
+impl Proposal for PersistentGrant {
+    const KIND: ProposalKindTag = ProposalKindTag::ApprovePersistentGrant;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(proposal_persistent_grant::table)
+            .values(&BaseRow::new(proposal_id, settings)?)
+            .execute(conn)
+            .await?;
+
+        match &settings.specific {
+            Specific::EtherTransfer { targets, limit } => {
+                diesel::insert_into(proposal_persistent_grant_ether::table)
+                    .values(&EtherRow {
+                        proposal_id,
+                        window_secs: limit.window_secs,
+                        max_volume: limit.max_volume.to_vec(),
+                    })
+                    .execute(conn)
+                    .await?;
+
+                // Row at a time: SQLite has no multi-row VALUES clause in diesel-async.
+                for address in targets {
+                    diesel::insert_into(proposal_persistent_grant_ether_target::table)
+                        .values(&NewEtherTarget {
+                            proposal_id,
+                            address: address.to_vec(),
+                        })
+                        .execute(conn)
+                        .await?;
+                }
+            }
+            Specific::TokenTransfer {
+                token_contract,
+                receiver,
+                volume_limits,
+            } => {
+                diesel::insert_into(proposal_persistent_grant_token::table)
+                    .values(&TokenRow {
+                        proposal_id,
+                        token_contract: token_contract.to_vec(),
+                        receiver: receiver.map(|r| r.to_vec()),
+                    })
+                    .execute(conn)
+                    .await?;
+
+                for limit in volume_limits {
+                    diesel::insert_into(proposal_persistent_grant_token_limit::table)
+                        .values(&NewTokenLimit {
+                            proposal_id,
+                            window_secs: limit.window_secs,
+                            max_volume: limit.max_volume.to_vec(),
+                        })
+                        .execute(conn)
+                        .await?;
+                }
+            }
+        }
+        Ok(())
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        let base: BaseRow = proposal_persistent_grant::table
+            .find(proposal_id)
+            .select(BaseRow::as_select())
+            .first(conn)
+            .await?;
+
+        let ether: Option<EtherRow> = proposal_persistent_grant_ether::table
+            .find(proposal_id)
+            .select(EtherRow::as_select())
+            .first(conn)
+            .await
+            .optional()?;
+
+        let specific = if let Some(ether) = ether {
+            let addresses: Vec<Vec<u8>> = proposal_persistent_grant_ether_target::table
+                .filter(proposal_persistent_grant_ether_target::proposal_id.eq(proposal_id))
+                .select(proposal_persistent_grant_ether_target::address)
+                .load(conn)
+                .await?;
+            let targets = addresses
+                .iter()
+                .map(|address| fixed!(address))
+                .collect::<QueryResult<Vec<_>>>()?;
+            Specific::EtherTransfer {
+                targets,
+                limit: VolumeLimit {
+                    max_volume: fixed!(ether.max_volume)?,
+                    window_secs: ether.window_secs,
+                },
+            }
+        } else {
+            let token: TokenRow = proposal_persistent_grant_token::table
+                .find(proposal_id)
+                .select(TokenRow::as_select())
+                .first(conn)
+                .await?;
+            let rows: Vec<(i64, Vec<u8>)> = proposal_persistent_grant_token_limit::table
+                .filter(proposal_persistent_grant_token_limit::proposal_id.eq(proposal_id))
+                .select((
+                    proposal_persistent_grant_token_limit::window_secs,
+                    proposal_persistent_grant_token_limit::max_volume,
+                ))
+                .load(conn)
+                .await?;
+            let volume_limits = rows
+                .into_iter()
+                .map(|(window_secs, max_volume)| {
+                    Ok(VolumeLimit {
+                        max_volume: fixed!(max_volume)?,
+                        window_secs,
+                    })
+                })
+                .collect::<QueryResult<Vec<_>>>()?;
+            Specific::TokenTransfer {
+                token_contract: fixed!(token.token_contract)?,
+                receiver: fixed!(opt token.receiver)?,
+                volume_limits,
+            }
+        };
+
+        base.into_settings(specific)
+    }
+}
--- a/server/crates/arbiter-server/src/db/proposal/replace_operator.rs
+++ b/server/crates/arbiter-server/src/db/proposal/replace_operator.rs
@@ -0,0 +1,51 @@
+//! Replacing an operator's key, which also triggers a Shamir re-key (§3.3).
+
+use super::{Proposal, ProposalKindTag};
+use crate::db::{
+    DatabaseConnection,
+    models::{OperatorIdentityId, ProposalId},
+    schema::proposal_replace_operator as table,
+};
+use diesel::{
+    ExpressionMethods as _, Insertable, QueryDsl as _, QueryResult, Queryable, Selectable,
+    SelectableHelper as _, sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, PartialEq, Eq, Queryable, Selectable, Insertable)]
+#[diesel(table_name = table, check_for_backend(Sqlite))]
+pub struct Settings {
+    pub old_operator_id: OperatorIdentityId,
+    pub new_pubkey: Vec<u8>,
+}
+
+pub struct ReplaceOperator;
+
+impl Proposal for ReplaceOperator {
+    const KIND: ProposalKindTag = ProposalKindTag::ReplaceOperator;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(table::table)
+            .values((table::proposal_id.eq(proposal_id), settings))
+            .execute(conn)
+            .await
+            .map(drop)
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        table::table
+            .find(proposal_id)
+            .select(Settings::as_select())
+            .first(conn)
+            .await
+    }
+}
--- a/server/crates/arbiter-server/src/db/proposal/trigger_rekey.rs
+++ b/server/crates/arbiter-server/src/db/proposal/trigger_rekey.rs
@@ -0,0 +1,28 @@
+//! A Shamir re-key over the current operator set (§3.3).
+
+use super::{Proposal, ProposalKindTag};
+use crate::db::{DatabaseConnection, models::ProposalId};
+use diesel::QueryResult;
+
+pub struct TriggerRekey;
+
+impl Proposal for TriggerRekey {
+    const KIND: ProposalKindTag = ProposalKindTag::TriggerRekey;
+
+    type Settings = ();
+
+    async fn insert(
+        _proposal_id: ProposalId,
+        _settings: &Self::Settings,
+        _conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        Ok(())
+    }
+
+    async fn load(
+        _proposal_id: ProposalId,
+        _conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        Ok(())
+    }
+}
--- a/server/crates/arbiter-server/src/db/schema.rs
+++ b/server/crates/arbiter-server/src/db/schema.rs
@@ -157,6 +157,7 @@ diesel::table! {
        id -> Nullable<Integer>,
        share -> Binary,
        share_nonce -> Binary,
+        share_salt -> Binary,
        created_at -> Integer,
        updated_at -> Integer,
    }
@@ -171,6 +172,165 @@ diesel::table! {
    }
 }

+diesel::table! {
+    proposal (id) {
+        id -> Integer,
+        kind -> Text,
+        initiator_id -> Integer,
+        created_at -> Integer,
+        expires_at -> Integer,
+        status -> Text,
+    }
+}
+
+diesel::table! {
+    proposal_approve_sdk_client (proposal_id) {
+        proposal_id -> Integer,
+        client_id -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal_grant_wallet_access (proposal_id) {
+        proposal_id -> Integer,
+        wallet_id -> Integer,
+        client_id -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal_replace_operator (proposal_id) {
+        proposal_id -> Integer,
+        old_operator_id -> Integer,
+        new_pubkey -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_one_off_transaction (proposal_id) {
+        proposal_id -> Integer,
+        client_id -> Integer,
+        wallet_address -> Binary,
+        chain_id -> BigInt,
+        nonce -> BigInt,
+        gas_limit -> BigInt,
+        max_fee_per_gas -> Binary,
+        max_priority_fee_per_gas -> Binary,
+        to_address -> Binary,
+        value -> Binary,
+        input -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant (proposal_id) {
+        proposal_id -> Integer,
+        wallet_access_id -> Integer,
+        chain_id -> BigInt,
+        valid_from -> Nullable<BigInt>,
+        valid_until -> Nullable<BigInt>,
+        max_gas_fee_per_gas -> Nullable<Binary>,
+        max_priority_fee_per_gas -> Nullable<Binary>,
+        rate_limit_count -> Nullable<Integer>,
+        rate_limit_window_secs -> Nullable<BigInt>,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant_ether (proposal_id) {
+        proposal_id -> Integer,
+        window_secs -> BigInt,
+        max_volume -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant_ether_target (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        address -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant_token (proposal_id) {
+        proposal_id -> Integer,
+        token_contract -> Binary,
+        receiver -> Nullable<Binary>,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant_token_limit (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        window_secs -> BigInt,
+        max_volume -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_one_off_transaction_result (proposal_id) {
+        proposal_id -> Integer,
+        r -> Binary,
+        s -> Binary,
+        y_parity -> Integer,
+        created_at -> Integer,
+    }
+}
+
+diesel::table! {
+    recovery_operator (id) {
+        id -> Integer,
+        share -> Binary,
+        share_nonce -> Binary,
+        share_salt -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    recovery_operator_identity (id) {
+        id -> Integer,
+        public_key -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    recovery_wakeup_request (id) {
+        id -> Integer,
+        requested_by -> Integer,
+        requested_at -> Integer,
+        cancelled_by -> Nullable<Integer>,
+        cancelled_at -> Nullable<Integer>,
+    }
+}
+
+diesel::table! {
+    recovery_proposal_vote (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        recovery_operator_id -> Integer,
+        approve -> Bool,
+        signature -> Binary,
+        voted_at -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal_vote (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        operator_id -> Integer,
+        approve -> Bool,
+        signature -> Binary,
+        voted_at -> Integer,
+    }
+}
+
 diesel::table! {
    program_client (id) {
        id -> Integer,
@@ -224,9 +384,38 @@ diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
 diesel::joinable!(evm_wallet_access -> program_client (client_id));
 diesel::joinable!(operator -> operator_identity (id));
 diesel::joinable!(program_client -> client_metadata (metadata_id));
+diesel::joinable!(proposal -> operator_identity (initiator_id));
+diesel::joinable!(proposal_one_off_transaction_result -> proposal_one_off_transaction (proposal_id));
+diesel::joinable!(proposal_approve_sdk_client -> proposal (proposal_id));
+diesel::joinable!(proposal_grant_wallet_access -> proposal (proposal_id));
+diesel::joinable!(proposal_replace_operator -> proposal (proposal_id));
+diesel::joinable!(proposal_one_off_transaction -> proposal (proposal_id));
+diesel::joinable!(proposal_persistent_grant -> proposal (proposal_id));
+diesel::joinable!(proposal_persistent_grant_ether -> proposal_persistent_grant (proposal_id));
+diesel::joinable!(proposal_persistent_grant_token -> proposal_persistent_grant (proposal_id));
+diesel::joinable!(proposal_vote -> proposal (proposal_id));
+diesel::joinable!(proposal_vote -> operator_identity (operator_id));
+diesel::joinable!(recovery_operator -> recovery_operator_identity (id));
+diesel::joinable!(recovery_proposal_vote -> proposal (proposal_id));
+diesel::joinable!(recovery_proposal_vote -> recovery_operator_identity (recovery_operator_id));
+diesel::joinable!(recovery_wakeup_request -> operator_identity (requested_by));

 diesel::allow_tables_to_appear_in_same_query!(
    aead_encrypted,
+    proposal_one_off_transaction_result,
+    proposal_approve_sdk_client,
+    proposal_grant_wallet_access,
+    proposal_replace_operator,
+    proposal_one_off_transaction,
+    proposal_persistent_grant,
+    proposal_persistent_grant_ether,
+    proposal_persistent_grant_ether_target,
+    proposal_persistent_grant_token,
+    proposal_persistent_grant_token_limit,
+    recovery_operator,
+    recovery_operator_identity,
+    recovery_wakeup_request,
+    recovery_proposal_vote,
    arbiter_settings,
    client_metadata,
    client_metadata_history,
@@ -244,6 +433,8 @@ diesel::allow_tables_to_appear_in_same_query!(
    operator,
    operator_identity,
    program_client,
+    proposal,
+    proposal_vote,
    root_key_history,
    tls_history,
 );
--- a/server/crates/arbiter-server/src/evm/safe_signer.rs
+++ b/server/crates/arbiter-server/src/evm/safe_signer.rs
@@ -44,7 +44,7 @@ impl std::fmt::Debug for SafeSigner {
 /// Returns the protected key bytes and the derived Ethereum address.
 pub fn generate(rng: &mut impl rand::Rng) -> (SafeCell<[u8; 32]>, Address) {
    loop {
-        let mut cell = SafeCell::new_inline(|w: &mut [u8; 32]| {
+        let mut cell = SafeCell::new_inline_default(|w: &mut [u8; 32]| {
            rng.fill_bytes(w);
        });

--- a/server/crates/arbiter-server/src/grpc/operator.rs
+++ b/server/crates/arbiter-server/src/grpc/operator.rs
@@ -19,6 +19,7 @@ use tracing::{error, info, warn};

 mod auth;
 mod evm;
+mod governance;
 mod inbound;
 mod outbound;
 mod sdk_client;
@@ -115,6 +116,7 @@ async fn dispatch_inner(
            warn!("Unsupported post-auth operator auth request");
            Err(Status::invalid_argument("Unsupported operator request"))
        }
+        OperatorRequestPayload::Governance(req) => governance::dispatch(actor, req).await,
    }
 }

--- a/server/crates/arbiter-server/src/grpc/operator/governance.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/governance.rs
@@ -0,0 +1,253 @@
+use crate::{
+    actors::proposal_manager::{Error as ProposalError, VoteOutcome},
+    db::models::{OperatorIdentityId, ProposalId},
+    db::proposal::{
+        ProposalKind, approve_sdk_client, grant_wallet_access, one_off_transaction,
+        persistent_grant, replace_operator,
+    },
+    peers::operator::{
+        OperatorSession,
+        session::handlers::{HandleCastVote, HandleCreateProposal, HandleQueryPending},
+    },
+};
+use arbiter_proto::proto::operator::{
+    governance::{
+        self as proto_gov, CreateProposalRequest, QueryPendingRequest, QueryPendingResponse,
+        VoteOutcome as ProtoVoteOutcome, create_proposal_request::Kind as ProtoKind,
+        request::Payload as GovRequestPayload, response::Payload as GovResponsePayload,
+    },
+    operator_response::Payload as OperatorResponsePayload,
+};
+use kameo::actor::ActorRef;
+use tonic::Status;
+use tracing::warn;
+
+const fn wrap(payload: GovResponsePayload) -> OperatorResponsePayload {
+    OperatorResponsePayload::Governance(proto_gov::Response {
+        payload: Some(payload),
+    })
+}
+
+pub(super) async fn dispatch(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_gov::Request,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let Some(payload) = req.payload else {
+        return Err(Status::invalid_argument(
+            "Missing governance request payload",
+        ));
+    };
+
+    match payload {
+        GovRequestPayload::Create(req) => handle_create(actor, req).await,
+        GovRequestPayload::Vote(req) => handle_vote(actor, req).await,
+        GovRequestPayload::Query(QueryPendingRequest {}) => handle_query(actor).await,
+    }
+}
+
+async fn handle_create(
+    actor: &ActorRef<OperatorSession>,
+    req: CreateProposalRequest,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let kind = match req.kind {
+        Some(ProtoKind::ApproveSdkClient(p)) => {
+            ProposalKind::ApproveSdkClient(approve_sdk_client::Settings {
+                client_id: p.client_id,
+            })
+        }
+        Some(ProtoKind::GrantWalletAccess(p)) => {
+            ProposalKind::GrantWalletAccess(grant_wallet_access::Settings {
+                wallet_id: p.wallet_id,
+                client_id: p.client_id,
+            })
+        }
+        Some(ProtoKind::ReplaceOperator(p)) => {
+            ProposalKind::ReplaceOperator(replace_operator::Settings {
+                old_operator_id: OperatorIdentityId::from_raw(p.old_operator_id),
+                new_pubkey: p.new_pubkey,
+            })
+        }
+        Some(ProtoKind::TriggerRekey(())) => ProposalKind::TriggerRekey,
+        Some(ProtoKind::ApprovePersistentGrant(p)) => {
+            ProposalKind::ApprovePersistentGrant(Box::new(parse_persistent_grant(p)?))
+        }
+        Some(ProtoKind::ApproveOneOffTransaction(p)) => {
+            ProposalKind::ApproveOneOffTransaction(Box::new(parse_one_off_transaction(p)?))
+        }
+        None => return Err(Status::invalid_argument("Missing proposal kind")),
+    };
+    let proposal_id = actor
+        .ask(HandleCreateProposal {
+            kind,
+            ttl_secs: req.ttl_secs,
+        })
+        .await
+        .map_err(|e| {
+            warn!(?e, "create_proposal failed");
+            Status::internal("Failed to create proposal")
+        })?;
+
+    Ok(Some(wrap(GovResponsePayload::Created(
+        proto_gov::CreateProposalResponse {
+            proposal_id: proposal_id.to_raw(),
+        },
+    ))))
+}
+
+/// Validates the grant where the request enters, so a malformed one is refused before
+/// any operator votes on it instead of failing after quorum.
+fn parse_persistent_grant(
+    p: proto_gov::ApprovePersistentGrantPayload,
+) -> Result<persistent_grant::Settings, Status> {
+    use proto_gov::approve_persistent_grant_payload::Specific;
+
+    let volume =
+        |l: proto_gov::VolumeLimitProto| -> Result<persistent_grant::VolumeLimit, Status> {
+            Ok(persistent_grant::VolumeLimit {
+                max_volume: fixed(&l.max_volume, "max_volume must be 32 bytes")?,
+                window_secs: l.window_secs,
+            })
+        };
+
+    let specific = match p.specific {
+        Some(Specific::EtherTransfer(spec)) => {
+            let targets = spec
+                .targets
+                .iter()
+                .map(|target| fixed(target, "ether transfer target must be 20 bytes"))
+                .collect::<Result<Vec<_>, _>>()?;
+            let limit = spec
+                .limit
+                .ok_or_else(|| Status::invalid_argument("missing ether transfer limit"))?;
+            persistent_grant::Specific::EtherTransfer {
+                targets,
+                limit: volume(limit)?,
+            }
+        }
+        Some(Specific::TokenTransfer(spec)) => {
+            let volume_limits = spec
+                .volume_limits
+                .into_iter()
+                .map(volume)
+                .collect::<Result<Vec<_>, _>>()?;
+            persistent_grant::Specific::TokenTransfer {
+                token_contract: fixed(&spec.token_contract, "token_contract must be 20 bytes")?,
+                receiver: spec
+                    .target
+                    .map(|t| fixed(&t, "token transfer target must be 20 bytes"))
+                    .transpose()?,
+                volume_limits,
+            }
+        }
+        None => return Err(Status::invalid_argument("missing grant specific")),
+    };
+
+    Ok(persistent_grant::Settings {
+        wallet_access_id: p.wallet_access_id,
+        chain_id: p.chain_id,
+        valid_from_secs: p.valid_from_secs,
+        valid_until_secs: p.valid_until_secs,
+        max_gas_fee_per_gas: p
+            .max_gas_fee_per_gas
+            .map(|v| fixed(&v, "max_gas_fee_per_gas must be 32 bytes"))
+            .transpose()?,
+        max_priority_fee_per_gas: p
+            .max_priority_fee_per_gas
+            .map(|v| fixed(&v, "max_priority_fee_per_gas must be 32 bytes"))
+            .transpose()?,
+        rate_limit: p.rate_limit.map(|r| persistent_grant::RateLimit {
+            count: r.count,
+            window_secs: r.window_secs,
+        }),
+        specific,
+    })
+}
+
+fn fixed<const N: usize>(bytes: &[u8], message: &'static str) -> Result<[u8; N], Status> {
+    <[u8; N]>::try_from(bytes).map_err(|_| Status::invalid_argument(message))
+}
+
+/// Validates the transaction where the request enters, so a malformed one is refused
+/// before any operator votes on it instead of failing after quorum.
+fn parse_one_off_transaction(
+    p: proto_gov::ApproveOneOffTransactionPayload,
+) -> Result<one_off_transaction::Settings, Status> {
+    Ok(one_off_transaction::Settings {
+        client_id: p.client_id,
+        wallet_address: fixed(&p.wallet_address, "wallet_address must be 20 bytes")?,
+        chain_id: p.chain_id,
+        nonce: p.nonce,
+        gas_limit: p.gas_limit,
+        max_fee_per_gas: u128::from_be_bytes(fixed(
+            &p.max_fee_per_gas,
+            "max_fee_per_gas must be 16 bytes",
+        )?),
+        max_priority_fee_per_gas: u128::from_be_bytes(fixed(
+            &p.max_priority_fee_per_gas,
+            "max_priority_fee_per_gas must be 16 bytes",
+        )?),
+        to: fixed(&p.to, "to must be 20 bytes")?,
+        value: fixed(&p.value, "value must be 32 bytes")?,
+        input: p.input,
+    })
+}
+
+async fn handle_vote(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_gov::CastVoteRequest,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let result = actor
+        .ask(HandleCastVote {
+            proposal_id: ProposalId::from_raw(req.proposal_id),
+            approve: req.approve,
+            signature: req.signature,
+        })
+        .await;
+
+    let outcome = match result {
+        Ok(VoteOutcome::Pending) => ProtoVoteOutcome::Pending,
+        Ok(VoteOutcome::Approved) => ProtoVoteOutcome::Approved,
+        Ok(VoteOutcome::Rejected) => ProtoVoteOutcome::Rejected,
+        Err(kameo::error::SendError::HandlerError(ProposalError::AlreadyVoted)) => {
+            return Err(Status::invalid_argument("Already voted on this proposal"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::InvalidSignature)) => {
+            return Err(Status::invalid_argument("Invalid vote signature"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::ProposalNotFound)) => {
+            return Err(Status::not_found("Proposal not found"));
+        }
+        Err(e) => {
+            warn!(?e, "cast_vote failed");
+            return Err(Status::internal("Failed to cast vote"));
+        }
+    };
+
+    Ok(Some(wrap(GovResponsePayload::Voted(
+        proto_gov::VoteResponse {
+            outcome: outcome.into(),
+        },
+    ))))
+}
+
+async fn handle_query(
+    actor: &ActorRef<OperatorSession>,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let summaries = actor.ask(HandleQueryPending {}).await.unwrap_or_default();
+
+    let proposals = summaries
+        .into_iter()
+        .map(|s| proto_gov::ProposalSummary {
+            id: s.id.to_raw(),
+            kind: <&'static str>::from(s.kind).to_owned(),
+            initiator_id: s.initiator_id.to_raw(),
+            expires_at: s.expires_at.0.timestamp(),
+            approve_count: s.approve_count,
+            reject_count: s.reject_count,
+        })
+        .collect();
+
+    Ok(Some(wrap(GovResponsePayload::Pending(
+        QueryPendingResponse { proposals },
+    ))))
+}
--- a/server/crates/arbiter-server/src/grpc/operator/vault.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault.rs
@@ -1,16 +1,24 @@
 use crate::{
    actors::vault::VaultState,
-    peers::operator::{OperatorSession, session::handlers::HandleQueryVaultState},
+    peers::operator::{
+        OperatorSession,
+        session::handlers::{
+            HandleContributeRecoveryRekeyPassphrase, HandleContributeRekeyPassphrase,
+            HandleQueryVaultState,
+        },
+    },
 };
 use arbiter_proto::{
-    proto::shared::VaultState as ProtoVaultState,
    proto::operator::{
        operator_response::Payload as OperatorResponsePayload,
        vault::{
-            self as proto_vault, request::Payload as VaultRequestPayload,
+            self as proto_vault,
+            rekey::{self as proto_rekey, RekeyResult as ProtoRekeyResult},
+            request::Payload as VaultRequestPayload,
            response::Payload as VaultResponsePayload,
        },
    },
+    proto::shared::VaultState as ProtoVaultState,
 };

 use kameo::actor::ActorRef;
@@ -33,6 +41,7 @@ pub(super) async fn dispatch(

    match payload {
        VaultRequestPayload::QueryState(()) => handle_query_vault_state(actor).await,
+        VaultRequestPayload::Rekey(req) => handle_rekey(actor, req).await,
        VaultRequestPayload::Unseal(_) | VaultRequestPayload::Bootstrap(_) => {
            Err(Status::permission_denied(
                "Vault is already unsealed; unseal/bootstrap not permitted in session",
@@ -41,6 +50,51 @@ pub(super) async fn dispatch(
    }
 }

+async fn handle_rekey(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_rekey::Request,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    use arbiter_proto::proto::operator::vault::rekey::request::Payload as RekeyPayload;
+
+    let payload = req
+        .payload
+        .ok_or_else(|| Status::invalid_argument("Missing rekey payload"))?;
+
+    let done: bool = match payload {
+        RekeyPayload::ContributePassphrase(cp) => actor
+            .ask(HandleContributeRekeyPassphrase {
+                passphrase: cp.passphrase,
+            })
+            .await
+            .map_err(|e| {
+                warn!(?e, "rekey passphrase contribution failed");
+                Status::internal("Rekey contribution failed")
+            })?,
+        RekeyPayload::ContributeRecoveryPassphrase(crp) => actor
+            .ask(HandleContributeRecoveryRekeyPassphrase {
+                recovery_operator_id: crp.recovery_operator_id,
+                passphrase: crp.passphrase,
+            })
+            .await
+            .map_err(|e| {
+                warn!(?e, "rekey recovery passphrase contribution failed");
+                Status::internal("Rekey recovery contribution failed")
+            })?,
+    };
+
+    let proto_result = if done {
+        ProtoRekeyResult::Success
+    } else {
+        ProtoRekeyResult::AwaitingContributions
+    };
+
+    Ok(Some(wrap_vault_response(VaultResponsePayload::Rekey(
+        proto_rekey::Response {
+            result: proto_result.into(),
+        },
+    ))))
+}
+
 async fn handle_query_vault_state(
    actor: &ActorRef<OperatorSession>,
 ) -> Result<Option<OperatorResponsePayload>, Status> {
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
@@ -1,14 +1,17 @@
 use crate::{
    grpc::{Convert, TryConvert},
    peers::operator::vault_gate::{
-        self as vault_gate, HandleBootstrapEncryptedKey, HandleHandshake, HandleUnsealEncryptedKey,
+        self as vault_gate, HandleBootstrapEncryptedKey, HandleContributeBootstrapPassphrase,
+        HandleContributeRecoveryBootstrapPassphrase, HandleContributeRecoveryUnsealPassphrase,
+        HandleContributeUnsealPassphrase, HandleDeclareCommittee, HandleHandshake,
+        HandleUnsealEncryptedKey,
    },
 };
 use arbiter_proto::proto::operator::{
    operator_request::Payload as OperatorRequestPayload,
    vault::{
        self as proto_vault,
-        bootstrap::{self as proto_bootstrap},
+        bootstrap::{self as proto_bootstrap, request::Payload as BootstrapRequestPayload},
        request::Payload as VaultRequestPayload,
        unseal::{self as proto_unseal, request::Payload as UnsealRequestPayload},
    },
@@ -50,6 +53,9 @@ impl TryConvert for VaultRequestPayload {
            Self::QueryState(()) => Ok(vault_gate::Inbound::HandleVaultState),
            Self::Unseal(req) => req.try_convert(),
            Self::Bootstrap(req) => req.try_convert(),
+            Self::Rekey(_) => Err(Status::permission_denied(
+                "Rekey requires an authenticated session",
+            )),
        }
    }
 }
@@ -73,6 +79,21 @@ impl TryConvert for UnsealRequestPayload {
        match self {
            Self::Start(start) => start.try_convert(),
            Self::EncryptedKey(key) => Ok(key.convert()),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeUnsealPassphrase(
+                    HandleContributeUnsealPassphrase {
+                        passphrase: cp.passphrase,
+                    },
+                ),
+            ),
+            Self::ContributeRecoveryPassphrase(crp) => Ok(
+                vault_gate::Inbound::HandleContributeRecoveryUnsealPassphrase(
+                    HandleContributeRecoveryUnsealPassphrase {
+                        recovery_operator_id: crp.recovery_operator_id,
+                        passphrase: crp.passphrase,
+                    },
+                ),
+            ),
        }
    }
 }
@@ -107,12 +128,44 @@ impl TryConvert for proto_bootstrap::Request {
    type Error = Status;

    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
-        self.encrypted_key
-            .ok_or_else(|| Status::invalid_argument("Missing bootstrap encrypted key"))?
+        self.payload
+            .ok_or_else(|| Status::invalid_argument("Missing bootstrap payload"))?
            .try_convert()
    }
 }

+impl TryConvert for BootstrapRequestPayload {
+    type Output = vault_gate::Inbound;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
+        match self {
+            Self::EncryptedKey(key) => key.try_convert(),
+            Self::DeclareCommittee(dc) => Ok(
+                vault_gate::Inbound::HandleDeclareCommittee(HandleDeclareCommittee {
+                    count: dc.count as usize,
+                    recovery_count: dc.recovery_count as usize,
+                }),
+            ),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeBootstrapPassphrase(
+                    HandleContributeBootstrapPassphrase {
+                        passphrase: cp.passphrase,
+                    },
+                ),
+            ),
+            Self::ContributeRecoveryPassphrase(crp) => Ok(
+                vault_gate::Inbound::HandleContributeRecoveryBootstrapPassphrase(
+                    HandleContributeRecoveryBootstrapPassphrase {
+                        recovery_operator_id: crp.recovery_operator_id,
+                        passphrase: crp.passphrase,
+                    },
+                ),
+            ),
+        }
+    }
+}
+
 impl TryConvert for proto_bootstrap::BootstrapEncryptedKey {
    type Output = vault_gate::Inbound;
    type Error = Status;
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
@@ -4,7 +4,6 @@ use crate::{
    peers::operator::vault_gate::{self as vault_gate},
 };
 use arbiter_proto::proto::{
-    shared::VaultState as ProtoVaultState,
    operator::{
        operator_response::Payload as OperatorResponsePayload,
        vault::{
@@ -17,6 +16,7 @@ use arbiter_proto::proto::{
            },
        },
    },
+    shared::VaultState as ProtoVaultState,
 };

 use tonic::Status;
@@ -110,6 +110,68 @@ impl TryConvert for vault_gate::Outbound {
                };
                Ok(wrap_bootstrap_response(proto_result))
            }
+            Self::HandleDeclareCommittee(result) => {
+                let proto_result = match result {
+                    Ok(()) => ProtoBootstrapResult::Success,
+                    Err(err) => {
+                        warn!(?err, "declare committee failed");
+                        return Err(Status::internal("Failed to declare committee"));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeBootstrapPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoBootstrapResult::Success,
+                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
+                    Err(err) => {
+                        warn!(?err, "contribute bootstrap passphrase failed");
+                        return Err(Status::internal("Failed to contribute bootstrap passphrase"));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeRecoveryBootstrapPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoBootstrapResult::Success,
+                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
+                    Err(err) => {
+                        warn!(?err, "contribute recovery bootstrap passphrase failed");
+                        return Err(Status::internal(
+                            "Failed to contribute recovery bootstrap passphrase",
+                        ));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeUnsealPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoUnsealResult::Success,
+                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
+                    Err(err) => {
+                        warn!(?err, "contribute unseal passphrase failed");
+                        return Err(Status::internal("Failed to contribute unseal passphrase"));
+                    }
+                };
+                Ok(wrap_unseal_response(UnsealResponsePayload::Result(
+                    proto_result.into(),
+                )))
+            }
+            Self::HandleContributeRecoveryUnsealPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoUnsealResult::Success,
+                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
+                    Err(err) => {
+                        warn!(?err, "contribute recovery unseal passphrase failed");
+                        return Err(Status::internal(
+                            "Failed to contribute recovery unseal passphrase",
+                        ));
+                    }
+                };
+                Ok(wrap_unseal_response(UnsealResponsePayload::Result(
+                    proto_result.into(),
+                )))
+            }
        }
    }
 }
--- a/server/crates/arbiter-server/src/peers/client/auth.rs
+++ b/server/crates/arbiter-server/src/peers/client/auth.rs
@@ -12,7 +12,7 @@ use crate::{
        schema::program_client,
    },
 };
-use arbiter_crypto::authn::{self, AuthChallenge, CLIENT_CONTEXT};
+use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::{
    ClientMetadata,
    transport::{Bi, expect_message},
@@ -298,7 +298,7 @@ where

    let signature = expect_message(transport, |req: Inbound| match req {
        Inbound::AuthChallengeSolution { signature } => Some(signature),
-        _ => None,
+        Inbound::AuthChallengeRequest { .. } => None,
    })
    .await
    .map_err(|e| {
@@ -306,7 +306,7 @@ where
        Error::Transport
    })?;

-    if !pubkey.verify(&challenge, CLIENT_CONTEXT, &signature) {
+    if !pubkey.verify(&challenge, SigningContext::Client, &signature) {
        error!("Challenge solution verification failed");
        return Err(Error::InvalidChallengeSolution);
    }
--- a/server/crates/arbiter-server/src/peers/operator/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/state.rs
@@ -7,26 +7,26 @@ use crate::{
    db::{DatabasePool, schema::operator_identity},
    peers::operator::auth::Outbound,
 };
-use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
+use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::transport::Bi;

 use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl};
 use diesel_async::RunQueryDsl;
 use tracing::error;

-pub(super) struct ChallengeRequest {
-    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
+pub(crate) struct ChallengeRequest {
+    pub(crate) pubkey: authn::PublicKey,
+    pub(crate) bootstrap_token: Option<String>,
 }

-pub(super) struct ChallengeContext {
-    pub(super) challenge: AuthChallenge,
-    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
+pub struct ChallengeContext {
+    pub challenge: AuthChallenge,
+    pub pubkey: authn::PublicKey,
+    pub bootstrap_token: Option<String>,
 }

-pub(super) struct ChallengeSolution {
-    pub(super) solution: Vec<u8>,
+pub(crate) struct ChallengeSolution {
+    pub(crate) solution: Vec<u8>,
 }

 smlang::statemachine!(
@@ -127,8 +127,6 @@ where
        })
    }

-    #[allow(missing_docs)]
-    #[allow(clippy::unused_unit)]
    async fn verify_solution(
        &mut self,
        ChallengeContext {
@@ -143,7 +141,7 @@ where
            Error::InvalidChallengeSolution
        })?;

-        let valid = pubkey.verify(challenge, OPERATOR_CONTEXT, &signature);
+        let valid = pubkey.verify(challenge, SigningContext::Operator, &signature);

        if !valid {
            self.transport
--- a/server/crates/arbiter-server/src/peers/operator/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/mod.rs
@@ -180,6 +180,7 @@ where

    Ok(OperatorSession::spawn(OperatorSession::new(
        props.clone(),
+        creds.clone(),
        oob_sender,
    )))
 }
--- a/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
@@ -1,9 +1,10 @@
 use super::{Error, OperatorSession};
+use crate::db::models::{OperatorIdentityId, ProposalId};
 use crate::{
    actors::{
        evm::{
-            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-            SignTransactionError as EvmSignError,
+            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorDeleteGrant,
+            OperatorListGrants, SignTransactionError as EvmSignError,
        },
        flow_coordinator::client_connect_approval::ClientApprovalAnswer,
        vault::VaultState,
@@ -122,22 +123,23 @@ impl OperatorSession {
    }

    #[message]
-    pub(crate) fn handle_grant_delete(&mut self, grant_id: i32) -> Result<(), GrantMutationError> {
-        // match self
-        //     .props
-        //     .actors
-        //     .evm
-        //     .ask(OperatorDeleteGrant { grant_id })
-        //     .await
-        // {
-        //     Ok(()) => Ok(()),
-        //     Err(err) => {
-        //         error!(?err, "EVM grant delete failed");
-        //         Err(GrantMutationError::Internal)
-        //     }
-        // }
-        let _ = grant_id;
-        todo!()
+    pub(crate) async fn handle_grant_delete(
+        &mut self,
+        grant_id: i32,
+    ) -> Result<(), GrantMutationError> {
+        match self
+            .props
+            .actors
+            .evm
+            .ask(OperatorDeleteGrant { grant_id })
+            .await
+        {
+            Ok(()) => Ok(()),
+            Err(err) => {
+                error!(?err, "EVM grant delete failed");
+                Err(GrantMutationError::Internal)
+            }
+        }
    }

    #[message]
@@ -217,8 +219,8 @@ impl OperatorSession {
    pub(crate) async fn handle_list_wallet_access(
        &mut self,
    ) -> Result<Vec<EvmWalletAccess>, Error> {
-        let mut conn = self.props.db.get().await?;
        use crate::db::schema::evm_wallet_access;
+        let mut conn = self.props.db.get().await?;
        let access_entries = evm_wallet_access::table
            .select(EvmWalletAccess::as_select())
            .load::<_>(&mut conn)
@@ -278,3 +280,102 @@ impl OperatorSession {
        Ok(clients)
    }
 }
+
+#[messages]
+impl OperatorSession {
+    #[message]
+    pub(crate) async fn handle_create_proposal(
+        &mut self,
+        kind: crate::db::proposal::ProposalKind,
+        ttl_secs: Option<u32>,
+    ) -> Result<ProposalId, Error> {
+        use crate::actors::proposal_manager::CreateProposal;
+        let initiator_id = OperatorIdentityId::from_raw(self.credentials.id);
+        self.props
+            .actors
+            .proposal_manager
+            .ask(CreateProposal { kind, initiator_id, ttl_secs })
+            .await
+            .map_err(|e| {
+                error!(?e, "create_proposal failed");
+                Error::internal("Failed to create proposal")
+            })
+    }
+
+    #[message]
+    pub(crate) async fn handle_cast_vote(
+        &mut self,
+        proposal_id: ProposalId,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<crate::actors::proposal_manager::VoteOutcome, crate::actors::proposal_manager::Error> {
+        use crate::actors::proposal_manager::CastVote;
+        let operator_id = OperatorIdentityId::from_raw(self.credentials.id);
+        self.props
+            .actors
+            .proposal_manager
+            .ask(CastVote { proposal_id, operator_id, approve, signature })
+            .await
+            .map_err(|err| match err {
+                SendError::HandlerError(e) => e,
+                _ => crate::actors::proposal_manager::Error::ExecutionFailed("actor unavailable".to_owned()),
+            })
+    }
+
+    #[message]
+    pub(crate) async fn handle_query_pending(
+        &mut self,
+    ) -> Vec<crate::actors::proposal_manager::ProposalSummary> {
+        use crate::actors::proposal_manager::QueryPending;
+        let operator_id = OperatorIdentityId::from_raw(self.credentials.id);
+        self.props
+            .actors
+            .proposal_manager
+            .ask(QueryPending { operator_id })
+            .await
+            .unwrap_or_default()
+    }
+}
+
+#[messages]
+impl OperatorSession {
+    #[message]
+    pub(crate) async fn handle_contribute_rekey_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        use crate::actors::vault_coordinator::ContributeRekey;
+        use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+
+        let operator_id = self.credentials.id;
+        self.props
+            .actors
+            .vault_coordinator
+            .ask(ContributeRekey {
+                operator_id,
+                passphrase: SafeCell::new(passphrase),
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub(crate) async fn handle_contribute_recovery_rekey_passphrase(
+        &mut self,
+        recovery_operator_id: i32,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        use crate::actors::vault_coordinator::ContributeRecoveryRekey;
+        use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+
+        self.props
+            .actors
+            .vault_coordinator
+            .ask(ContributeRecoveryRekey {
+                recovery_operator_id,
+                passphrase: SafeCell::new(passphrase),
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+}
--- a/server/crates/arbiter-server/src/peers/operator/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/mod.rs
@@ -1,4 +1,4 @@
-use super::{OutOfBand, OperatorConnection};
+use super::{Credentials, OutOfBand, OperatorConnection};
 use crate::{
    actors::{
        flow_coordinator::client_connect_approval::ClientApprovalController,
@@ -51,6 +51,7 @@ pub struct PendingClientApproval {

 pub struct OperatorSession {
    props: OperatorConnection,
+    credentials: Credentials,
    sender: Box<dyn Sender<OutOfBand>>,

    pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
@@ -59,11 +60,12 @@ pub struct OperatorSession {
 pub mod handlers;

 impl OperatorSession {
-    pub(crate) fn new(props: OperatorConnection, sender: Box<dyn Sender<OutOfBand>>) -> Self {
+    pub(crate) fn new(props: OperatorConnection, credentials: Credentials, sender: Box<dyn Sender<OutOfBand>>) -> Self {
        Self {
            props,
+            credentials,
            sender,
-            pending_client_approvals: Default::default(),
+            pending_client_approvals: HashMap::default(),
        }
    }
 }
--- a/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
@@ -3,8 +3,12 @@ use crate::{
    actors::{
        GlobalActors,
        vault::{self, Bootstrap, GetState, TryUnseal, VaultState, events},
+        vault_coordinator::{
+            ContributeBootstrap, ContributeRecoveryBootstrap, ContributeRecoveryUnseal,
+            ContributeUnseal, StartBootstrap,
+        },
    },
-    crypto::integrity::{self},
+    crypto::{KeyCell, integrity::{self}},
    db::DatabasePool,
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -17,6 +21,9 @@ use tokio::sync::oneshot;
 use tracing::{error, info};
 use x25519_dalek::{EphemeralSecret, PublicKey, SharedSecret};

+pub use VaultGateMessage as Inbound;
+pub use VaultGateMessageReply as Outbound;
+
 pub mod state;

 #[derive(Debug, thiserror::Error)]
@@ -98,11 +105,9 @@ impl VaultGate {
        nonce: &[u8],
        ciphertext: &[u8],
        associated_data: &[u8],
-    ) -> Result<SafeCell<Vec<u8>>, ()> {
+    ) -> Result<KeyCell, ()> {
        let nonce = XNonce::from_slice(nonce);
-
        let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());
-
        let mut key_buffer = SafeCell::new(ciphertext.to_vec());

        let decryption_result = key_buffer.write_inline(|write_handle| {
@@ -110,7 +115,9 @@ impl VaultGate {
        });

        match decryption_result {
-            Ok(()) => Ok(key_buffer),
+            Ok(()) => KeyCell::try_from(key_buffer).map_err(|()| {
+                error!("Decrypted key material has unexpected length");
+            }),
            Err(err) => {
                error!(?err, "Failed to decrypt encrypted key material");
                Err(())
@@ -119,7 +126,7 @@ impl VaultGate {
    }
 }

-#[messages(messages = Inbound, replies = Outbound)]
+#[messages(enum)]
 impl VaultGate {
    #[message]
    pub fn handle_handshake(
@@ -152,17 +159,14 @@ impl VaultGate {
            return Err(Error::State);
        };

-        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        else {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
            return Err(Error::InvalidKey);
        };

        match self
            .actors
            .vault
-            .ask(TryUnseal {
-                seal_key_raw: seal_key_buffer,
-            })
+            .ask(TryUnseal { seal_key })
            .await
        {
            Ok(()) => {
@@ -192,17 +196,14 @@ impl VaultGate {
            return Err(Error::State);
        };

-        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        else {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
            return Err(Error::InvalidKey);
        };

        match self
            .actors
            .vault
-            .ask(Bootstrap {
-                seal_key_raw: seal_key_buffer,
-            })
+            .ask(Bootstrap { seal_key })
            .await
        {
            Ok(()) => {
@@ -234,6 +235,89 @@ impl VaultGate {

        Ok(answer)
    }
+
+    #[message]
+    pub async fn handle_declare_committee(
+        &mut self,
+        count: usize,
+        recovery_count: usize,
+    ) -> Result<(), Error> {
+        self.actors
+            .vault_coordinator
+            .ask(StartBootstrap {
+                operator_id: self.auth_creds.id,
+                declared_count: count,
+                recovery_count,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_bootstrap_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeBootstrap {
+                operator_id: self.auth_creds.id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_recovery_bootstrap_passphrase(
+        &mut self,
+        recovery_operator_id: i32,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeRecoveryBootstrap {
+                recovery_operator_id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_unseal_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeUnseal {
+                operator_id: self.auth_creds.id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_recovery_unseal_passphrase(
+        &mut self,
+        recovery_operator_id: i32,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeRecoveryUnseal {
+                recovery_operator_id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
 }

 impl Message<events::Bootstrapped> for VaultGate {
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -1,8 +1,5 @@
 use super::common::ChannelTransport;
-use arbiter_crypto::{
-    authn::{self, AuthChallenge, CLIENT_CONTEXT},
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::{
    ClientMetadata,
    transport::{Receiver, Sender},
@@ -74,7 +71,7 @@ async fn insert_registered_client(
 fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
    let challenge = challenge.format();
    key.signing_key()
-        .sign_deterministic(&challenge, CLIENT_CONTEXT)
+        .sign_deterministic(&challenge, SigningContext::Client.as_bytes())
        .unwrap()
        .into()
 }
@@ -100,7 +97,7 @@ async fn spawn_test_actors(db: &db::DatabasePool) -> GlobalActors {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
--- a/server/crates/arbiter-server/tests/common/mod.rs
+++ b/server/crates/arbiter-server/tests/common/mod.rs
@@ -2,7 +2,6 @@
    dead_code,
    reason = "Common test utilities that may not be used in every test"
 )]
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::transport::{Bi, Error, Receiver, Sender};
 use arbiter_server::{
    actors::{GlobalActors, vault::Vault},
@@ -19,7 +18,7 @@ pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
        .await
        .unwrap();
    actor
-        .bootstrap(SafeCell::new(b"test-seal-key".to_vec()))
+        .bootstrap(arbiter_server::crypto::KeyCell::from([0u8; 32]))
        .await
        .unwrap();
    actor
--- a/server/crates/arbiter-server/tests/governance.rs
+++ b/server/crates/arbiter-server/tests/governance.rs
--- a/server/crates/arbiter-server/tests/operator/auth.rs
+++ b/server/crates/arbiter-server/tests/operator/auth.rs
@@ -1,8 +1,5 @@
 use super::common::ChannelTransport;
-use arbiter_crypto::{
-    authn::{self, AuthChallenge, OPERATOR_CONTEXT},
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::transport::{Error as TransportError, Receiver, Sender};
 use arbiter_server::{
    actors::{GlobalActors, bootstrap::GetToken, vault::Bootstrap},
@@ -27,7 +24,7 @@ fn sign_operator_challenge(
 ) -> authn::Signature {
    let challenge = challenge.format();
    key.signing_key()
-        .sign_deterministic(&challenge, OPERATOR_CONTEXT)
+        .sign_deterministic(&challenge, SigningContext::Operator.as_bytes())
        .unwrap()
        .into()
 }
@@ -157,7 +154,7 @@ pub async fn bootstrap_token_auth() {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -275,7 +272,7 @@ pub async fn challenge_auth() {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -361,7 +358,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -434,7 +431,7 @@ pub async fn challenge_auth_rejects_invalid_signature() {
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
--- a/server/crates/arbiter-server/tests/operator/unseal.rs
+++ b/server/crates/arbiter-server/tests/operator/unseal.rs
@@ -1,7 +1,4 @@
-use arbiter_crypto::{
-    authn,
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use arbiter_crypto::authn;
 use arbiter_server::{
    actors::{
        GlobalActors,
@@ -22,7 +19,7 @@ use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};

 async fn setup_sealed_gate(
-    seal_key: &[u8],
+    seal_key: &[u8; 32],
 ) -> (
    db::DatabasePool,
    kameo::actor::ActorRef<VaultGate>,
@@ -34,7 +31,7 @@ async fn setup_sealed_gate(
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(seal_key.to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from(*seal_key),
        })
        .await
        .unwrap();
@@ -50,7 +47,7 @@ async fn setup_sealed_gate(

 async fn client_dh_encrypt(
    gate: &kameo::actor::ActorRef<VaultGate>,
-    key_to_send: &[u8],
+    key_to_send: &[u8; 32],
 ) -> HandleUnsealEncryptedKey {
    let client_secret = EphemeralSecret::random();
    let client_public = PublicKey::from(&client_secret);
@@ -83,7 +80,7 @@ async fn client_dh_encrypt(
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_success() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    let encrypted_key = client_dh_encrypt(&gate, seal_key).await;
@@ -95,10 +92,10 @@ pub async fn unseal_success() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_wrong_seal_key() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

-    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;

    let response = gate.ask(encrypted_key).await;
    assert!(matches!(
@@ -112,7 +109,7 @@ pub async fn unseal_wrong_seal_key() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_corrupted_ciphertext() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    let client_secret = EphemeralSecret::random();
@@ -143,11 +140,11 @@ pub async fn unseal_corrupted_ciphertext() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_retry_after_invalid_key() {
-    let seal_key = b"real-seal-key";
+    let seal_key = b"real-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    {
-        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;

        let response = gate.ask(encrypted_key).await;
        assert!(matches!(
--- a/server/crates/arbiter-server/tests/vault/concurrency.rs
+++ b/server/crates/arbiter-server/tests/vault/concurrency.rs
@@ -166,7 +166,7 @@ async fn decrypt_roundtrip_after_high_concurrency() {
        .await
        .unwrap();
    decryptor
-        .try_unseal(SafeCell::new(b"test-seal-key".to_vec()))
+        .try_unseal(arbiter_server::crypto::KeyCell::from([0u8; 32]))
        .await
        .unwrap();

--- a/server/crates/arbiter-server/tests/vault/lifecycle.rs
+++ b/server/crates/arbiter-server/tests/vault/lifecycle.rs
@@ -3,14 +3,19 @@ use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_server::{
    actors::{
        GlobalActors,
-        vault::{Error, Vault},
+        vault::{Error, GetState, Vault, VaultState},
+        vault_coordinator::{
+            ContributeBootstrap, ContributeRecoveryBootstrap, ContributeRecoveryUnseal,
+            Error as CoordinatorError, StartBootstrap, VaultCoordinator,
+        },
    },
-    crypto::encryption::v1::{Nonce, ROOT_KEY_TAG},
+    crypto::{KeyCell, encryption::v1::{Nonce, ROOT_KEY_TAG}},
    db::{self, models, schema},
 };

-use diesel::{QueryDsl, SelectableHelper};
+use diesel::{ExpressionMethods, QueryDsl, SelectableHelper, insert_into};
 use diesel_async::RunQueryDsl;
+use kameo::actor::Spawn as _;

 #[tokio::test]
 #[test_log::test]
@@ -20,7 +25,7 @@ async fn test_bootstrap() {
        .await
        .unwrap();

-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = KeyCell::from([0u8; 32]);
    actor.bootstrap(seal_key).await.unwrap();

    let mut conn = db.get().await.unwrap();
@@ -43,7 +48,7 @@ async fn test_bootstrap_rejects_double() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

-    let seal_key2 = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key2 = KeyCell::from([0u8; 32]);
    let err = actor.bootstrap(seal_key2).await.unwrap_err();
    assert!(matches!(err, Error::AlreadyBootstrapped));
 }
@@ -105,7 +110,7 @@ async fn test_unseal_correct_password() {
    let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
        .await
        .unwrap();
-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = KeyCell::from([0u8; 32]);
    actor.try_unseal(seal_key).await.unwrap();

    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
@@ -129,13 +134,137 @@ async fn test_unseal_wrong_then_correct_password() {
        .await
        .unwrap();

-    let bad_key = SafeCell::new(b"wrong-password".to_vec());
+    let bad_key = KeyCell::from([1u8; 32]);
    let err = actor.try_unseal(bad_key).await.unwrap_err();
    assert!(matches!(err, Error::InvalidKey));

-    let good_key = SafeCell::new(b"test-seal-key".to_vec());
+    let good_key = KeyCell::from([0u8; 32]);
    actor.try_unseal(good_key).await.unwrap();

    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }
+
+#[tokio::test]
+#[test_log::test]
+async fn two_operator_vault_requires_recovery_share() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db, vault_ref));
+
+    let err = coordinator
+        .ask(StartBootstrap {
+            operator_id: 1,
+            declared_count: 2,
+            recovery_count: 0,
+        })
+        .await
+        .unwrap_err();
+
+    assert!(
+        matches!(
+            err,
+            kameo::error::SendError::HandlerError(CoordinatorError::TwoOperatorsRequireRecovery)
+        ),
+        "expected TwoOperatorsRequireRecovery, got {err:?}"
+    );
+}
+
+/// §3.4: Bootstrap with 1 ordinary + 1 recovery operator produces a valid 1-of-2 Shamir split.
+/// Both ordinary and recovery shares are stored; the vault can be unsealed with either one.
+#[tokio::test]
+#[test_log::test]
+async fn recovery_share_stored_and_used_for_unseal() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref.clone()));
+
+    // Register one ordinary operator and one recovery operator in the DB
+    let ordinary_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![1u8; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    let recovery_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values(schema::recovery_operator_identity::public_key.eq(vec![2u8; 32]))
+            .returning(schema::recovery_operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+
+    // Declare committee: 1 ordinary + 1 recovery
+    coordinator
+        .ask(StartBootstrap {
+            operator_id: ordinary_id,
+            declared_count: 1,
+            recovery_count: 1,
+        })
+        .await
+        .unwrap();
+
+    // Recovery operator contributes first — bootstrap should not finalize yet
+    let done = coordinator
+        .ask(ContributeRecoveryBootstrap {
+            recovery_operator_id: recovery_id,
+            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(!done, "should not finalize with only recovery passphrase");
+
+    // Ordinary operator contributes — now bootstrap finalizes
+    let done = coordinator
+        .ask(ContributeBootstrap {
+            operator_id: ordinary_id,
+            passphrase: SafeCell::new(b"ordinary-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(done, "should finalize once all contributors are in");
+
+    // After bootstrap, vault is Unsealed (seal key still in memory).
+    let state = vault_ref.ask(GetState {}).await.unwrap();
+    assert_eq!(state, VaultState::Unsealed);
+
+    // Verify recovery_operator row was created
+    let recovery_share_count: i64 = {
+        let mut conn = db.get().await.unwrap();
+        schema::recovery_operator::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    assert_eq!(recovery_share_count, 1);
+
+    // Simulate restart: drop vault and coordinator, create fresh vault (comes up Sealed).
+    drop(coordinator);
+    drop(vault_ref);
+    let bus2 = GlobalActors::spawn_message_bus();
+    let vault_ref2 = Vault::spawn(Vault::new(db.clone(), bus2).await.unwrap());
+    let state = vault_ref2.ask(GetState {}).await.unwrap();
+    assert_eq!(state, VaultState::Sealed);
+
+    // §3.5: Unseal using ONLY the recovery operator share (threshold = shamir_threshold(1) = 1).
+    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
+    let done = coordinator2
+        .ask(ContributeRecoveryUnseal {
+            recovery_operator_id: recovery_id,
+            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(done, "recovery share alone should satisfy threshold");
+
+    let state = vault_ref2.ask(GetState {}).await.unwrap();
+    assert_eq!(state, VaultState::Unsealed);
+}
Author	SHA1	Message	Date
CleverWild	9e9672a1b1	refactor(crypto): extract governance vote message and verification helpers	2026-08-27 16:44:22 +02:00
CleverWild	0d29d0d532	refactor(db): declare unixepoch instead of formatting a SQL fragment	2026-08-27 14:08:48 +02:00
CleverWild	e9496da78c	perf(proposal): replace the per-proposal tally loop with one grouped query	2026-08-27 14:00:14 +02:00
CleverWild	c0546fa17f	refactor(db): use diesel exists() instead of counting rows	2026-08-27 13:50:02 +02:00
CleverWild	71081b6ee7	refactor(proposal): use id newtypes across the governance path	2026-08-27 13:42:14 +02:00
CleverWild	8421a09d9f	refactor(db!: store the one-off transaction signature by component	2026-08-27 12:46:40 +02:00
CleverWild	15b826310b	refactor(db): replace the proposal payload blob with typed child tables	2026-08-27 00:45:35 +02:00
CleverWild	5698d1cfb3	feat(proposal): reject proposals with an excessive TTL	2026-08-26 16:47:12 +02:00
CleverWild	6884a59325	refactor(proposal): type ProposalSummary::kind as ProposalKindTag	2026-08-26 16:32:43 +02:00
CleverWild	b364d95489	refactor(proposal): drop the Quorum prefix from VoteOutcome variants	2026-08-26 15:30:48 +02:00
CleverWild	d64478b301	refactor(proposal): replace UpdateShamirParameters with parameterless TriggerRekey	2026-08-26 15:26:17 +02:00
CleverWild	aa884339f7	refactor(proposal): remove the ApproveServerUpdate proposal kind	2026-08-26 14:53:38 +02:00
CleverWild	180f93c1a7	refactor(proposal): derive ProposalKindTag from ProposalKind with strum	2026-08-26 14:36:41 +02:00
CleverWild	a501283b0c	refactor(crypto): replace byte-slice signing contexts with `SigningContext` enum	2026-08-26 14:08:32 +02:00
CleverWild	f881102f0a	refactor(proposal): drop the expired status, enforce expiry on every vote	2026-08-26 13:01:44 +02:00
CleverWild	f13c1cf9d1	fix(db): require share_salt to be supplied by the daemon	2026-08-26 13:01:44 +02:00
CleverWild	f03997ea56	chore(lints): fix regression caused by rust 1.98.0	2026-08-26 13:01:44 +02:00
CleverWild	957c5096df	chore(deps): bump kameo version	2026-08-26 13:01:44 +02:00
CleverWild	36249129d1	feat(vault)!: implement full Shamir re-key flow and governance execution (§3.3–§3.5) - Add `rekey.proto` with `ContributePassphrase` / `ContributeRecoveryPassphrase` / `RekeyResult` - Wire `rekey` as a 4th vault stream payload in `vault.proto` and gRPC dispatch - Add `RekeyRootKey` message to `Vault` actor: generates new random seal key, re-encrypts root key, writes new `root_key_history` row - Add `StartRekey`, `ContributeRekey`, `ContributeRecoveryRekey` messages to `VaultCoordinator`; `finalize_rekey` uses threshold-1 fast path identical to bootstrap - `execute_replace_operator` now UPDATEs `operator_identity.public_key` in-place (avoids FK constraint violation), deletes stale `operator` share row, then triggers `StartRekey` - `execute_update_shamir_parameters` triggers `StartRekey` instead of warning stub - `ProposalKind::ReplaceOperator` carries `old_operator_id`; encode/decode updated accordingly - `GlobalActors::spawn` extracts `vault_coordinator` before `Ok(Self { … })` so it can be cloned into `ProposalManager::new` - Add `handle_rekey` in session handlers forwarding passphrase contributions to `VaultCoordinator` - Fix test: rename `replace_operator_inserts_identity_row` → `replace_operator_updates_pubkey_and_starts_rekey`, assert count stays 1 and pubkey is updated	2026-08-26 13:01:44 +02:00
CleverWild	3817a080c9	refactor(proposal): replace string kind dispatch with ProposalKindTag enum (strum)	2026-08-26 13:01:44 +02:00
CleverWild	e1d060dd06	feat(vault): add recovery passphrase handling for bootstrap and unseal processes	2026-08-26 13:01:44 +02:00
CleverWild	e121708d28	fix(crypto): handle 1-of-N Shamir split when ordinary_count=1	2026-08-26 13:01:44 +02:00
CleverWild	6e3fa736e0	feat(server): recovery operators with sleeping/wakeup mechanism (§3.5/§3.6)	2026-08-26 13:01:44 +02:00
CleverWild	19a62e7195	feat(server): key-rotation proposals require full quorum (§3.3)	2026-08-26 13:01:44 +02:00
CleverWild	57200cbc50	feat(server): two-operator vault requires at least one recovery share	2026-08-26 13:01:44 +02:00
CleverWild	291ef2e831	refactor(server): typed pubkey len via u32::try_from in ReplaceOperator	2026-08-26 13:01:44 +02:00
CleverWild	d12109c2c9	feat(server): ProposalKind::ApproveOneOffTransaction	2026-08-26 13:01:44 +02:00
CleverWild	277fb3c92d	feat(server): ProposalKind::ApprovePersistentGrant	2026-08-26 13:01:44 +02:00
CleverWild	9e42097683	feat(server): ProposalKind::UpdateShamirParameters	2026-08-26 13:01:44 +02:00
CleverWild	25b86b14e9	feat(server): ProposalKind::ReplaceOperator	2026-08-26 13:01:44 +02:00
CleverWild	ba8748a17b	feat(server): ProposalKind ::GrantWalletAccess and ::ApproveServerUpdate	2026-08-26 13:01:44 +02:00
CleverWild	3e61d807b4	test(server): governance integration tests	2026-08-26 13:01:44 +02:00
CleverWild	e6459aade8	feat(server::grpc): wire governance RPCs through operator session	2026-08-26 13:01:44 +02:00
CleverWild	f16d0a26e2	feat(server): introduce ProposalManager actor with quorum voting logic	2026-08-26 13:01:44 +02:00
CleverWild	074e6501ec	feat(crypto): expose governance signing context and make shamir_threshold pub const	2026-08-26 13:01:44 +02:00
CleverWild	b2632661f8	feat(db): add proposal and proposal_vote tables	2026-08-26 13:01:44 +02:00
CleverWild	966b4c8828	feat(proto): add governance proposal/vote RPC definitions	2026-08-26 13:01:44 +02:00
CleverWild	b6c91c56eb	housekepping: add fixme for start_bootstrap's operator_id	2026-08-26 13:01:44 +02:00
CleverWild	240fd3eb63	refactor(server::crypto): use fixed-size [u8; 32] and KeyCell throughout seal key API	2026-08-26 13:01:44 +02:00
CleverWild	80ba30d430	fix(server::tests): tighten unseal test seal_key params to &[u8; 32]	2026-08-26 13:01:44 +02:00
CleverWild	59cb65f3e1	feat(server::grpc): wire Shamir committee bootstrap and unseal proto messages Adds DeclareCommittee and ContributePassphrase variants to bootstrap.proto, ContributePassphrase to unseal.proto, and AwaitingContributions result codes to both. Implements corresponding inbound converters and outbound reply mappings. VaultGate handlers delegate to VaultCoordinator.	2026-08-26 13:01:44 +02:00
CleverWild	83075e9df7	feat(server): introduce VaultCoordinator for multi-operator Shamir bootstrap/unseal VaultCoordinator collects operator passphrases, splits the seal key into Shamir shares on bootstrap (encrypting each share with the operator's passphrase via Argon2 + XChaCha20-Poly1305), and reconstructs the seal key from threshold shares on unseal. Adds vsss-rs 5.4.0 and rand_core 0.6 dependencies.	2026-08-26 13:01:44 +02:00
CleverWild	fc7f2b1a03	refactor(server::actors::vault): clean up Bootstrap/TryUnseal, remove Bootstrapping state Bootstrap and TryUnseal now accept a SafeCell<Vec<u8>> seal key directly. The Bootstrapping intermediate state is removed — multi-operator coordination is the responsibility of VaultCoordinator, which calls Bootstrap atomically once all shares are collected.	2026-08-26 13:01:44 +02:00
CleverWild	0695ec96a8	feat(server::crypto): add Shamir secret sharing utilities Wraps vsss_rs Gf256::split_array / combine_array into thin split_key / combine_shares helpers. Also widens derive_key salt parameter from &[u8;16] to &[u8] to accommodate the 32-byte share salts.	2026-08-26 13:01:44 +02:00
CleverWild	8159902027	feat(server::db): add share_salt column to operator table Each operator row now stores a 32-byte random salt used to derive the per-operator share encryption key from their passphrase (Argon2 KDF).	2026-08-26 13:01:44 +02:00
CleverWild	928799fa07	feat(server::actors::evm): implement operator_delete_grant Sets revoked_at on the evm_basic_grant row; returns NotFound if the grant does not exist. Wires the handler in OperatorSession replacing the todo!().	2026-08-26 13:01:44 +02:00
CleverWild	3d3a4be806	fix(server::peers::operator::auth): make ChallengeContext pub for smlang state machine smlang generates a public state enum whose variants contain ChallengeContext, requiring the type itself to be fully public. Also tightens the wildcard arm in client auth to an exhaustive match.	2026-08-26 13:01:44 +02:00
Skipper	28b7276e11	WIP: some things	2026-08-26 13:01:44 +02:00